BYTETOOLS

SSL Certificate Decoder

Decode an SSL/TLS certificate to read its subject, issuer, validity dates, SANs, key size and SHA-256 fingerprint. Runs entirely in your browser.

…or drop a .pem, .crt, .cer or .der fileRead locally with FileReader — never uploaded

What is the SSL Certificate Decoder?

An SSL certificate decoder parses the Base64-encoded X.509 structure and shows you what is actually inside it: who it was issued to, who signed it, when it expires, which hostnames it covers and its fingerprints.

  • Full X.509 field breakdown: version, serial, issuer, subject, validity and public key
  • Every extension decoded, including key usage, extended key usage and basic constraints
  • Complete Subject Alternative Name list with DNS, IP, email and URI entries
  • SHA-1 and SHA-256 fingerprints computed with the Web Crypto API
  • Expiry countdown with clear warnings for expired or not-yet-valid certificates
  • Accepts PEM, bare Base64, hex, and binary .der files dropped from disk

How to use the SSL Certificate Decoder

  1. 1

    Paste the certificate, including the BEGIN CERTIFICATE and END CERTIFICATE lines, or drop a .pem, .crt, .cer or .der file onto the drop zone.

  2. 2

    Click Decode certificate — or press Load sample certificate to see the output shape first.

  3. 3

    Read the summary tiles for the key type, version and days until expiry.

  4. 4

    Check the Subject Alternative Names panel to confirm every hostname you need is covered.

  5. 5

    Copy the SHA-256 fingerprint or the plain-text summary if you need to compare it with another system.

About the SSL Certificate Decoder

Paste a PEM certificate and this decoder walks the ASN.1 structure byte by byte, showing the version, serial number, signature algorithm, issuer and subject distinguished names, validity window, public key size and every extension the certificate carries — including the Subject Alternative Names that browsers actually use for hostname matching.

It is the tool you reach for when a deployment fails and you need to know whether the certificate on disk is the one you think it is. It shows days remaining until expiry, flags certificates that have already expired or are not yet valid, and computes the SHA-1 and SHA-256 fingerprints you can compare against a certificate pinned elsewhere.

Everything is decoded locally by JavaScript in this tab. Your certificate is never uploaded, and no CA, OCSP responder or Certificate Transparency log is contacted — this tool reads structure only, so it can tell you what a certificate claims but not whether a real CA still trusts it.

Frequently asked questions

How do I read the contents of an SSL certificate?

Paste the PEM block into the box above and click Decode certificate. You will get the subject, issuer, validity dates, key size, SANs and fingerprints without installing anything. It is the same information openssl x509 -text prints, just in a readable layout.

Does this tool check whether my certificate is trusted?

No. It reads the structure of the certificate you paste and nothing more. Verifying trust means building a chain to a root store and checking revocation, which needs network access to the issuing CA — this tool deliberately makes no requests at all.

Why does my certificate work in some browsers but not others?

Almost always a missing Subject Alternative Name. Browsers have ignored the Common Name for hostname matching since 2017, so a certificate whose CN is your domain but whose SAN list is empty or wrong will be rejected. Check the SAN panel above.

What is the difference between the SHA-1 and SHA-256 fingerprints?

They are two different hashes of the same certificate bytes, used as short identifiers. SHA-256 is the one to use today; SHA-1 fingerprints still appear in older tooling and network appliances, so both are shown for comparison.

Is it safe to paste a certificate into a web page?

A certificate is public by design — it is sent to every client that connects to your server, so there is nothing secret in it. Even so, this tool decodes it locally in your browser and never uploads it. Never paste a private key anywhere, including here.

Related tools