BYTETOOLS

ASN.1 DER Decoder

Decode any DER or BER blob into a collapsible ASN.1 tree with tags, lengths, byte offsets and typed values including OIDs, times and integers.

…or drop a .der / .cer / .pem fileBinary DER is detected automatically

What is the ASN.1 DER Decoder?

An ASN.1 DER decoder reads binary DER data as a tree of tag-length-value elements, showing the type of each node, its byte offset and length, and its decoded value — the structure underneath every certificate, key and PKI message.

  • Collapsible TLV tree with byte offset, header length and content length on every node
  • Typed rendering for BOOLEAN, INTEGER, BIT STRING, OCTET STRING, OIDs, strings and times
  • Built-in name table for common PKIX, PKCS and X.500 object identifiers
  • Handles context-specific and application tags, long-form lengths and high tag numbers
  • Accepts PEM, Base64, hex or a dropped binary DER file
  • Depth, element-count and length guards so malformed input fails cleanly

How to use the ASN.1 DER Decoder

  1. 1

    Paste a PEM block, Base64 string or hex bytes into the input, or drop a .der, .cer or .pem file.

  2. 2

    Click Decode ASN.1 to build the tree, or try Load sample DER first.

  3. 3

    Click a chevron to collapse or expand any SEQUENCE or SET; use Expand all to reset the whole tree.

  4. 4

    Read each row for the byte offset, tag name, content length and decoded value.

  5. 5

    Use Copy tree to take the whole indented decode into a bug report or a commit message.

About the ASN.1 DER Decoder

DER is the binary encoding behind X.509 certificates, PKCS#8 keys, PKCS#7 signatures, CMS messages and timestamp responses. This decoder takes any DER or BER blob — as PEM, Base64 or hex — and renders it as a collapsible tree so you can see exactly how the bytes are structured.

Every node shows its byte offset, header size and content length, along with a decoded value: integers, booleans, bit strings with their unused-bit count, octet strings, UTC and generalized times converted to ISO form, and object identifiers resolved against a built-in table of common PKIX, PKCS and X.500 OIDs. Nested sequences and sets expand and collapse with a click.

This is the tool for the moment when a library rejects a structure and you need to know which byte is wrong. It runs entirely in your browser with no uploads, and it is bounded — nesting depth, element count and length-field width are all capped, so a malformed or hostile blob produces a clear error rather than a frozen tab.

Frequently asked questions

What is ASN.1 DER encoding?

ASN.1 describes data structures abstractly, and DER is one way of writing them as bytes. Each element is a tag saying what type it is, a length, and then the value. Certificates, private keys and most PKI formats are DER underneath their Base64 armour.

What is the difference between DER and BER?

BER allows several valid encodings of the same value; DER is a strict subset that permits exactly one, which matters when you sign something. This decoder reads both, including BER's indefinite-length form, which DER does not allow.

Why does my certificate start with the bytes 30 82?

0x30 is the tag for a constructed SEQUENCE, and 0x82 means the length is written in the next two bytes. Almost every certificate, key and CSR starts this way, which is a quick way to confirm you are looking at DER and not something else.

What does 'unused bits' mean on a BIT STRING?

A BIT STRING stores a count of bits, not bytes, so its first content byte says how many bits of the final byte to ignore. Key usage extensions use this, which is why a two-byte value can carry only nine meaningful flags.

Can I decode a private key with this tool?

Technically yes — a PKCS#8 key is just DER — but please do not paste private keys into any web page, including this one. Nothing is uploaded here, but building the habit is what matters. Use openssl asn1parse locally instead.

Related tools