PEM Certificate Decoder
Free online PEM certificate decoder. Paste an X.509 certificate or CSR to inspect subject, issuer, SANs, validity dates, serial number, and public key type.
Loading tool...
What is PEM Certificate Decoder?
The PEM Certificate Decoder lets you read the contents of any X.509 certificate or certificate signing request by pasting it into your browser. It parses the ASN.1/DER structure locally and presents the subject and issuer, the complete Subject Alternative Names list, validity dates with live expiration status, the serial number, signature algorithm, and public key type and size. Nothing is uploaded, making it safe for production and internal certificates.
Key Benefits
- Confirm exactly which domains and IPs a certificate covers via its SANs before deploying.
- Catch expired or not-yet-valid certificates before they cause TLS outages.
- Verify CSR contents from vendors or teams against what you intended to request.
- Read RSA, EC, and Ed25519 key details without installing OpenSSL.
- Keep certificates private — parsing happens 100% in your browser.
Common Use Cases
- •Checking a renewed certificate before installing it on a load balancer or web server.
- •Debugging hostname mismatch errors by comparing SANs against the requested domain.
- •Reviewing a CSR from a developer or vendor before submitting it to your CA.
- •Auditing expiry dates across certificates collected from servers and secret stores.
- •Learning how X.509 fields map to what browsers and TLS tools actually validate.
How to Use the PEM Certificate Decoder
- Copy your PEM file: Open the .pem, .crt, .cer, or .csr file in a text editor and copy everything from -----BEGIN to -----END inclusive.
- Paste it into the tool: Paste the PEM block into the input box, or click Load sample to try the tool with a built-in certificate.
- Click Decode PEM: The parser reads the DER structure locally and shows version, serial, subject, issuer, validity, and key details.
- Review SANs and status: Check the Subject Alternative Names table for covered domains and the badges for expiration status, then copy any field you need.
Key Features
- Decodes both X.509 certificates and PKCS#10 CSRs from pasted PEM text.
- Shows subject and issuer distinguished names in CN/O/C form.
- Extracts every Subject Alternative Name: DNS, IP, email, and URI entries.
- Displays validity window with expired, not-yet-valid, and days-remaining status.
- Detects RSA key size, EC curves, and Ed25519/Ed448 key types.
- 100% client-side ASN.1 parsing — certificates never leave your browser.
Frequently Asked Questions
Does my certificate get uploaded anywhere?
No. The decoder parses the DER/ASN.1 structure entirely in your browser using JavaScript. The PEM text you paste never leaves your machine, which makes it safe for internal or production certificates.
Can it decode CSRs as well as certificates?
Yes. Paste a block with the header -----BEGIN CERTIFICATE REQUEST----- (or NEW CERTIFICATE REQUEST) and the tool shows the requested subject, public key type and size, signature algorithm, and any requested Subject Alternative Names.
Which key types are recognized?
RSA (with modulus size in bits), EC with named curves like P-256/P-384/P-521 or explicit parameters, and Ed25519/Ed448. The signature algorithm (SHA256withRSA, SHA256withECDSA, and friends) is shown too.
Why do I see fewer fields for a CSR than a certificate?
A CSR only contains what the requester submitted: subject, public key, and requested extensions. Fields like issuer, serial number, and validity are assigned by the certificate authority when it issues the final certificate.