Is my certificate uploaded anywhere?

No. The PEM is parsed entirely in your browser by a small built-in ASN.1 DER parser. Nothing is sent over the network.

What fields can you extract?

Subject, issuer (both as RDN sequences like CN=example.com,O=Org), validity (notBefore/notAfter), serial number (hex), the signature algorithm OID, the public-key algorithm OID, and the signature bytes. We also surface any printable strings found in the DER.

Why not use the browser's built-in X.509 parser?

Browsers don't expose a JavaScript API for parsing arbitrary X.509 certificates. They handle TLS internally but don't surface that to web pages, so we ship a minimal DER parser.

Can you parse private keys or CSRs?

Not yet — this decoder focuses on end-entity X.509 certificates. CSRs (PKCS#10) and private keys (PKCS#8 / PKCS#1) have different ASN.1 shapes.

What's the “validity status” badge?

We compare notBefore/notAfter to the current time and label the certificate as valid, expiring soon (within 14 days), expired, or not-yet-valid. Times are shown in UTC.

How complete is the parser?

It handles the core RFC 5280 Certificate structure (tbsCertificate, signatureAlgorithm, signature) and the common Name/Validity/AlgorithmIdentifier constructs. Extensions (SAN, AKI, SKI, KeyUsage) are surfaced as raw DER strings rather than fully decoded.

SSL Certificate Decoder

Decode a PEM certificate into subject, issuer, validity and serial — locally.

100% private — no uploads Security & Crypto ToolsFree & unlimited Read tutorial

See how it works

Watch a quick simulation of this tool in action — no file needed.

How to use SSL Certificate Decoder

Follow these steps — everything happens instantly in your browser.

1
Step 1. Paste your PEM certificate (including the BEGIN/END CERTIFICATE lines).
2
Step 2. Click “Decode certificate” — we base64-decode it to DER.
3
Step 3. Review subject, issuer, validity window, serial, signature algorithm and key algorithm.
4
Step 4. Check the validity badge (valid / expiring soon / expired) and copy the raw DER hex if needed.