CSR Decoder
Decode a PEM certificate signing request (CSR) in your browser and read its subject, public key details and signature algorithm.
About the CSR Decoder
This CSR decoder parses a PKCS#10 certificate signing request from PEM format and shows what it contains: the subject distinguished name (common name, organisation, country and more), the public key type and size, and the signature algorithm. It's the quickest way to confirm a CSR holds the details you intend before sending it to a certificate authority.
A CSR is the request you generate when applying for an SSL/TLS certificate. Getting a field wrong — a typo in the common name, the wrong organisation — means a wasted issuance cycle, so verifying it first is worth the moment it takes.
Decoding uses a built-in ASN.1/DER parser and runs entirely in your browser; your CSR is never uploaded. The private key is never part of a CSR, so pasting one here is safe.
How to Use the CSR Decoder
- 1Paste your CSR in PEM format (the -----BEGIN CERTIFICATE REQUEST----- block).
- 2Click Decode to parse it.
- 3Review the subject, public key and signature algorithm.
- 4Copy the decoded summary.
Frequently Asked Questions
What does a CSR contain?
A certificate signing request holds the subject distinguished name (common name, organisation, organisational unit, locality, state and country), the public key you're certifying, and a signature over the request made with the corresponding private key. It never contains the private key itself.
Is it safe to paste my CSR here?
Yes. A CSR contains only public information and a public key — never your private key — so there's nothing secret in it. On top of that, this tool decodes everything locally in your browser and uploads nothing.
Which fields should I check before submitting a CSR?
The common name (CN) must exactly match the domain you're securing, and the organisation and country must be correct for OV/EV certificates. Decode the CSR here and confirm these fields before sending it to your certificate authority to avoid a rejected or reissued certificate.
What key types can it read?
It identifies the public key algorithm (such as RSA or elliptic curve) and, for RSA, the key size in bits. Modern certificates typically use RSA 2048/4096 or ECDSA P-256/P-384 keys, and the decoder reports which your CSR uses.
Why won't my CSR decode?
The most common causes are pasting only part of the PEM block, extra characters, or providing a certificate or private key instead of a CSR. Make sure you paste the complete -----BEGIN CERTIFICATE REQUEST----- to -----END----- block. Some unusual attributes may not be fully parsed, but the core fields will still show.