X.509 Certificate Decoder
Paste a PEM certificate, or raw base64 or hex DER. Parsing runs entirely in your browser — nothing is uploaded.
| Version | v3 |
| Serial number | 21:18:ba:cd:e3:cb:ea:62:a3:3a:2a:67:f9:d3:6e:69 |
| Signature algorithm | ECDSA with SHA-256 |
| Issuer | O=Acme Co |
| Subject | O=Acme Co |
| Not before | 2017-10-20T19:43:06.000Z |
| Not after | 2018-10-20T19:43:06.000Z (expired 2873 days ago) |
| Public key | EC, P-256 (prime256v1), ~256 bits |
| Key usage (critical) | digitalSignature, keyEncipherment, keyCertSign |
| Extended key usage | TLS server authentication |
| Basic constraints (critical) | CA: TRUE |
| Subject alternative names | DNS:localhost:5453, DNS:127.0.0.1:5453 |
| SHA-256 fingerprint | 6f:e5:2a:48:36:b2:ec:7e:c9:e6:1f:03:4c:9f:6a:15:bb:4f:08:11:e2:ad:18:2b:c2:0d:e7:5e:e7:0f:f7:46 |
| SHA-1 fingerprint | 42:dc:8a:31:86:ed:b5:31:d1:cf:87:21:96:cd:8a:e7:a7:32:99:fe |
| Size | 393 bytes (DER) |
X.509 Certificate Decoder — Free Online Tool
Decodes an X.509 / TLS certificate from PEM or DER by parsing the ASN.1 structure in the browser, showing the version, serial number, signature algorithm, issuer and subject distinguished names, validity window with days remaining, public key algorithm and size, subject alternative names, basic constraints, key usage and extended key usage, plus SHA-256 and SHA-1 fingerprints.
How to use the X.509 Certificate Decoder
- Open the tool above — it runs entirely in your browser, so your input never leaves this page.
- Paste or type your input into the field, then press the relevant button (e.g. Encode / Decode, Generate, or Convert).
- Copy the result from the output area with the copy button orCtrl/Cmd + C.
- No signup, no upload, and no tracking — repeat as often as you need.
Frequently asked questions
Is my certificate uploaded anywhere?
No. The ASN.1 parsing and the fingerprints are computed in your browser with JavaScript. A certificate is public data, but the habit of pasting key material into a remote decoder is worth avoiding entirely.
Which formats can I paste?
PEM (the -----BEGIN CERTIFICATE----- block), raw base64 DER without the header lines, or hex with or without colons and a 0x prefix. A PEM bundle is decoded starting from its first certificate.
Why do the SHA-256 and SHA-1 fingerprints differ from my browser's?
They should not — both are digests of the full DER encoding, which is what browsers, OpenSSL and ssh show. If they differ, you are almost certainly hashing a different certificate in the chain: a fingerprint identifies one certificate, not the chain.
Free & private — why use this X.509 Certificate Decoder
The X.509 Certificate Decoder runs 100% client-side in your browser. Your data is never uploaded to a server, no account is required, and the tool is completely free. It works offline once the page has loaded and is part of a growing collection of privacy-first developer utilities.