SSL Certificate Decoder

Paste a PEM certificate or drop a .crt, .cer or .der file to see who it was issued to, who signed it, which domains it covers and when it expires. The certificate is parsed on this page by a small DER reader, so nothing is sent to a server and no URL inside it is ever contacted.

Runs locally — nothing you enter is sent Security Free · no signup

How to use

Paste a PEM certificate (the block from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----), or drop a .pem, .crt, .cer or .der file.
Paste several blocks to decode a whole chain; each certificate gets its own card, and the tool shows which one issued which.
Read the subject, issuer, validity (with days until expiry), key type and size, and the extensions such as Subject Alternative Name and Key Usage.
Compare the SHA-256 or SHA-1 fingerprint with the one your browser or server reports.
Click Copy details to copy everything as plain text. A dropped binary .der file is shown as PEM in the input box, ready to copy.

Examples

Input

-----BEGIN CERTIFICATE-----
MIIEiTCCA3GgAwIBAgIJASNFZ4mrze8BMA0GCSqGSIb3DQEBCwUAMH4x…
-----END CERTIFICATE-----

Decoded (excerpt)

Common name (CN): example.test
Not after: 2029-01-14 08:06:28 UTC (UTCTime)
Status: Valid: expires in 824 days
Public key: EC P-256 (256 bits)
Subject Alternative Name: DNS: example.test
    DNS: *.example.test
    IP: 192.0.2.10

Supported formats

PEM text (CERTIFICATE, X509 CERTIFICATE, TRUSTED CERTIFICATE), one block or a chain of several.
Binary DER files (.der, .cer, .crt) and PKCS#7 bundles (.p7b) in PEM or DER form.
Bare base64 without the BEGIN/END lines is accepted too.
Certificate signing requests and private keys are recognised and not decoded.

Privacy

This tool runs entirely in your browser. Nothing you enter or open is sent anywhere. Privacy policy.

Limitations

The tool reads certificates; it does not verify signatures, build a trust path to a root store or check revocation. A decoded certificate is not proof that it is trustworthy.
OCSP, CRL and CA issuer URLs are shown as text and never fetched, so revocation status is not checked.
It cannot connect to a website to fetch its certificate. Export it from your browser's certificate viewer or run openssl s_client, then paste it here.
Signed certificate timestamps (Certificate Transparency) are counted but not decoded, and rare extensions are listed by OID with their raw bytes.
PKCS#12 (.pfx / .p12) files are not supported: they normally contain a private key.

FAQ

How do I find when my SSL certificate expires?

Paste the certificate and look at Validity: Not after is the expiry date in UTC, and Status counts the days left (or how long ago it expired) from your device's clock.

Is it safe to paste a certificate here?

Yes. A certificate is public: every HTTPS server sends it to anyone who connects. It is decoded entirely in your browser in any case, with no network request. Private keys are a different matter. If you paste one, the tool refuses to decode it and clears the input box; never paste a private key into any website.

Why is the Common Name not enough?

Browsers ignore the CN and match the domain against the Subject Alternative Name list. If a host name is missing from the SANs, the certificate will not be accepted for it, whatever the CN says.

What does self-signed mean?

The subject and issuer are the same, so the certificate vouches for itself. Root CA certificates are self-signed by design; a self-signed server certificate is only trusted by machines where it has been installed manually.

How do I get the certificate of a website?

In most browsers click the padlock, open the certificate viewer and export it as PEM (Base64). From a terminal: openssl s_client -connect example.com:443 -showcerts prints the whole chain as PEM blocks you can paste here.