PEM Certificate Decoder
Decode and inspect X.509 PEM certificates. View subject, issuer, validity dates, SAN, and signature algorithm in your browser.
When a PEM certificate decoder is the right tool
Use this page to inspect one X.509 certificate that you already have as PEM. Paste the block, click Decode Certificate, and read the fields in your browser. It does not verify the signature, talk to a CA, or fetch a live site. To look up certificates published in CT logs for a hostname, use SSL Certificate Checker.
Use cases
Reading subject, issuer, and validity
A real certificate will typically show a version (often v3), a hex serial, an algorithm such as sha256WithRSAEncryption, a public-key type (RSA, EC, or Ed25519), and not-before / not-after timestamps labeled UTC.
Checking SAN and CA basic constraints
When those extensions exist, DNS names and IPv4 addresses appear on their own rows, and “Is CA” is shown as Yes or No. If basic constraints are absent, that row is omitted.
How parsing works
Headers matching -----…----- and whitespace are stripped, the remainder is base64-decoded, and a compact DER walker reads the TBS certificate. The result is shown only after you click Decode. Changing the textarea clears the panel.
What this tool does not do
It does not validate a chain, check revocation, decode private keys or CSRs, or prove that the signature is genuine. Do not treat a successful parse as proof that a certificate is trusted. Parsing stays in your browser.
How to use PEM Certificate Decoder
- Paste a single
-----BEGIN CERTIFICATE-----block. Avoid relying on Load sample — that placeholder is not a real certificate. - Click Decode Certificate.
- Read the fields. If the structure is invalid, an error is shown instead.
Frequently asked questions
How does PEM Certificate Decoder work?
Paste a PEM block and click Decode Certificate — the result does not update as you type, and editing the input clears a previous result. A local ASN.1/DER parser then reads an X.509 certificate and shows version, serial (colon-separated hex), signature and public-key algorithms, subject, issuer, not-before / not-after (labeled UTC), optional CA (basic constraints), and SAN DNS names and IPv4 addresses. Nothing is uploaded, and the signature is not verified.
What happens if I click Decode with an empty box, or use Load sample?
An empty or whitespace-only box still runs the bundled sample, which is a truncated placeholder, not a real certificate. That decode often “succeeds” with version v1, a serial-like hex string, and blank subject, issuer, and dates, instead of an error. Load sample pastes the same placeholder and does not decode until you click the button. Paste a real -----BEGIN CERTIFICATE----- block to inspect a certificate.
Can I decode a private key, a CSR, or a certificate chain?
No. This page is a single-certificate inspector. BEGIN/END markers are stripped and all remaining base64 is concatenated, so a chain or a mixed PEM file is not split into separate certificates. Private keys and CSRs are not supported; they may error with Invalid certificate structure or, like the sample, show a misleading partial result.
Which fields are shown, and which are skipped?
Known OIDs are mapped (for example sha256WithRSAEncryption, RSA, EC (ECDSA), Ed25519, and common subject attributes such as CN, O, and emailAddress). Other OIDs are shown raw. SAN entries other than DNS (tag dNSName) and iPAddress are ignored, and iPAddress values are joined as dotted decimals (fine for IPv4, misleading for IPv6). Key usage is parsed as raw hex but is not displayed. There is no fingerprint, extension dump, or trust-chain check.
Related tools and guides
References
- Certificate structure follows RFC 5280. This page is a small client-side parser, not a full X.509 library and not a path validator.
- Dates from UTCTime use a two-digit year window (values under 50 become 20xx; otherwise 19xx) and are displayed with a UTC label.