X.509 Certificate Decoder
Decode PEM and DER X.509 certificates to inspect subject, issuer, validity, fingerprints, and extensions
Interactive tool
PEM certificate
No certificate to decode
Paste a PEM-encoded certificate or drop a .pem/.crt file
What is an X.509 Certificate Decoder?
X.509 is the standard format for digital certificates used by TLS, S/MIME, code signing, and most authentication systems. A decoder parses a PEM-encoded certificate and surfaces the human-readable fields: subject and issuer names, validity window, serial number, signature algorithm, public key parameters, fingerprints, and extensions like Subject Alternative Name and Key Usage.
How to Use This X.509 Decoder
- 1Paste a PEM-encoded certificate (-----BEGIN CERTIFICATE----- block) or drop a .pem/.crt file
- 2Click Decode to parse the certificate
- 3Review subject, issuer, validity, fingerprints, and extensions
- 4Use the SHA-256 fingerprint to verify the certificate matches an expected one
- 5Inspect SAN entries to confirm which hostnames the certificate covers
Key features
PEM Input Support
Paste any PEM-encoded certificate exported from servers, browsers, or certificate authorities
Subject and Issuer Breakdown
Parsed Common Name, Organization, OU, Country, State, and Locality plus the full distinguished name
Validity Status
Color-coded summary of expiration: valid, expiring soon, or already expired
SHA-1 and SHA-256 Fingerprints
Colon-formatted thumbprints for fast manual verification
Subject Alternative Names
List every DNS, IP, email, and URI name covered by the certificate
Key Usage and Extended Key Usage
See exactly what the certificate is authorized to do (server auth, code signing, etc.)
Extension Inspection
Full extension table with OID, name, criticality, and summarized value
100% Private
Decoding runs in your browser. The certificate is never uploaded
Why Decode X.509 Certificates?
Engineers, ops teams, and security auditors regularly need to verify certificate properties before deploying. Pinning the wrong fingerprint, missing a SAN entry, or overlooking an expired certificate can take a service offline. A decoder gives a fast, dependency-free way to inspect what is actually inside a PEM file without invoking openssl, exporting binary tools, or trusting third-party online services with sensitive certificates.
Common use cases
- Verifying TLS certificate fingerprints before pinning
- Auditing certificate SAN coverage for multi-domain deployments
- Investigating expiry dates across an environment
- Inspecting client certificates received during mTLS debugging
- Comparing issued certificates against expected CA chains
- Reviewing key usage and extended key usage policies
- Onboarding teammates to PKI concepts with concrete examples
- Checking S/MIME certificates before sending signed email
PEM vs DER
PEM is base64-encoded DER wrapped in BEGIN/END markers. DER is the raw binary form. Most servers and CAs export PEM. If you have a .der or .cer binary file, convert it to PEM first (openssl x509 -inform der -in file.der -out file.pem) before pasting here.
Reading Fingerprints
Fingerprints are hashes of the certificate DER. SHA-256 is the modern default for certificate pinning and verification. SHA-1 fingerprints are still widely used for display in browsers, but should not be used as a security primitive on their own.
Tips & best practices
Always verify SHA-256 fingerprints
When pinning or comparing certificates, use SHA-256. Avoid SHA-1 fingerprints as a security boundary
Check SAN, not just CN
Modern browsers ignore the Common Name. The Subject Alternative Name extension is what actually matches a hostname
Watch for short validity windows
Most public CAs now issue certificates valid for 90-398 days. Set monitoring at 30 days remaining
Inspect Extended Key Usage
A certificate without serverAuth EKU cannot be used for HTTPS, even if everything else looks correct
Compare DER size for tampering checks
Two certificates with the same fingerprint will have identical DER size. Mismatched sizes are an early signal something changed
Privacy & security
This X.509 decoder runs entirely in your web browser using the @peculiar/x509 library and the SubtleCrypto API. Certificates are never uploaded to any server. Use it freely for production certificates, even those containing sensitive metadata.
Related tools
- TOTP Generator
Generate Time-based One-Time Passwords (2FA codes) from a secret with QR code for authenticator apps
Encoding Tools
- HMAC Generator
Generate HMAC signatures with SHA-1, SHA-256, SHA-384, and SHA-512 in hex or base64 output
Encoding Tools
- Unicode Converter
Convert text to and from Unicode escapes, code points, UTF-8 hex bytes, and Unicode normalization forms
Encoding Tools
- Currency Converter
Convert between 160+ world currencies with live daily-updated exchange rates. Supports a swap button, bulk conversion to multiple targets, and the rate timestamp so you always know how fresh the data is.
Finance Tools
- Background Remover
Remove solid or green-screen backgrounds with chroma keying. tolerance and feather in your browser. Sample key from a pixel or choose a color.
Image Tools
- JSON Formatter & Validator
Format, validate, and beautify JSON data instantly in your browser
Developer Tools
Frequently Asked Questions
What certificate formats are supported?
The decoder accepts PEM-encoded X.509 certificates, the most common format. PEM certificates start with "-----BEGIN CERTIFICATE-----" and end with "-----END CERTIFICATE-----". For binary DER certificates, convert to PEM first using openssl: openssl x509 -inform der -in file.der -out file.pem.
Why is my certificate showing as expired?
The decoder compares notBefore and notAfter timestamps to your local clock. If your device clock is wrong, expiry may show incorrectly. Verify your system time is accurate and that you are decoding the correct certificate.
What is the difference between Subject and Issuer?
Subject is the entity the certificate identifies (the owner). Issuer is the certificate authority that signed it. For self-signed certificates, subject and issuer are identical.
Why do I need Subject Alternative Names?
Modern browsers and many TLS libraries no longer trust the Common Name field for hostname matching. Every domain a certificate should cover must appear in the SAN extension. Missing SAN entries result in NET::ERR_CERT_COMMON_NAME_INVALID and similar errors.
How do I verify a fingerprint matches an expected value?
Compare the SHA-256 fingerprint shown by the decoder against the value provided by your CA, monitoring system, or pinning configuration. Both values are hex strings; compare exactly, ignoring case and colon separators.
Are my certificates uploaded anywhere?
No. The decoder runs entirely in your browser using the @peculiar/x509 library and the SubtleCrypto API. Certificates and their metadata never leave your device. The tool is safe for production certificates and certificates containing sensitive subject information.