Certificate Decoder
Decode an X.509 certificate (PEM) in your browser and read its subject, issuer, validity dates, serial number and public key details.
About the Certificate Decoder
This certificate decoder parses an X.509 certificate from PEM format and lays out its key fields: the subject and issuer distinguished names, the validity period (not-before and not-after dates), the serial number, the signature algorithm and the public key type and size. It's the fast way to inspect a certificate without command-line OpenSSL.
Whether you're debugging a TLS handshake, checking when a certificate expires, or confirming which authority issued it, seeing these fields decoded in plain text saves time and mistakes.
Decoding uses a built-in ASN.1/DER parser and runs entirely in your browser, so the certificate is never uploaded. Certificates are public by nature, so this is safe.
How to Use the Certificate Decoder
- 1Paste your certificate in PEM format (the -----BEGIN CERTIFICATE----- block).
- 2Click Decode to parse it.
- 3Review the subject, issuer, validity and key details.
- 4Copy the decoded summary.
Frequently Asked Questions
What details does the decoder show?
The subject (who the certificate is for), the issuer (which CA signed it), the validity window with not-before and not-after dates, the serial number, the signature algorithm, and the public key type and size. These are the fields you most often need when inspecting a certificate.
How do I check when a certificate expires?
Decode it and read the not-after (validity end) date. If it's in the past, the certificate has expired and browsers will reject it. Checking this is the quickest way to diagnose an expired-certificate error on a site or service.
Is it safe to paste a certificate here?
Yes. An X.509 certificate contains only public information — it's designed to be handed out to anyone connecting to a server. It never includes the private key. This tool also decodes locally in your browser and uploads nothing.
What's the difference between the subject and the issuer?
The subject identifies the entity the certificate belongs to (for a website, its domain in the common name or SANs). The issuer is the certificate authority that signed and vouches for it. For a self-signed certificate, the subject and issuer are the same.
Why won't my certificate decode?
Usually because only part of the PEM block was pasted, or the input is actually a certificate request or private key rather than a certificate. Paste the complete -----BEGIN CERTIFICATE----- to -----END----- block. Some extensions may not be fully expanded, but the core fields will still be shown.