SSL Certificate Decoder
Decode a certificate, chain or CSR and check its signatures and expiry.
Everything Inside A Certificate, In Plain Language
A certificate is a block of base64 that says a great deal: which domains it covers, who issued it, when it expires, what it may be used for, where to check whether it has been revoked. Decoding one by hand means OpenSSL and a lot of squinting. Paste it here and every field is laid out in plain terms, with a clear verdict on whether it is currently valid.
Paste a whole chain — what openssl s_client -showcerts prints — and each certificate’s signature is verified against the next one with your browser’s own cryptography, which confirms the chain is linked correctly. Certificate signing requests are decoded too, so you can check a CSR before sending it to a certificate authority.
Key features
- Certificates, chains and CSRs — PEM text, .crt, .cer or binary .der files.
- Validity at a glance — valid, expiring soon, expired or not yet valid.
- Every common extension — SANs, key usage, basic constraints, AIA, CRLs, policies and SCTs.
- Signature verification — each chain link checked with WebCrypto.
- SHA-256 and SHA-1 fingerprints — to compare with what a server presents.
This tool runs entirely inside your browser using native Web APIs. Your files and text are never uploaded to a server, never logged and never shared with third parties.
How to use: SSL Certificate Decoder
- Paste the certificate
Or open a .crt, .pem, .cer or .der file. - Read the verdict
Valid, expired or not yet valid, with days remaining. - Check the details
Subject alternative names, issuer, key and extensions. - Paste the whole chain
To verify that each certificate was signed by the next.
Technical specifications
| Processing location | Entirely in your browser — no server round trip |
|---|---|
| Data uploaded | None. Files and text never leave your device |
| Price | Free — no account, no trial, no usage cap |
| Category | Security |
| Works offline | Yes, once the page has loaded |
| Browser support | Chrome 90+, Edge 90+, Firefox 90+, Safari 15+ |
| Interface languages | English, 中文, हिन्दी, Español, العربية |
Frequently asked questions
How do I get a website’s certificate?
Click the padlock in your browser’s address bar and export the certificate, or run openssl s_client -connect yourdomain:443 -showcerts and copy the blocks between BEGIN and END CERTIFICATE.
What are subject alternative names?
The list of domain names and IP addresses the certificate is valid for. Browsers check the SAN list, not the Common Name, so a domain missing from it will show a certificate warning.
What does the signature check prove?
That each certificate in what you pasted was genuinely signed by the key of the next one. It does not prove the root is one your devices trust, or that the certificate has not been revoked — those need your system’s trust store and an online check.
Should I paste a private key?
No, and the tool refuses to decode one. A certificate and a CSR are public by design; a private key should never be pasted into any web page.
What is a CSR?
A certificate signing request: the public key and the names you want in the certificate, signed with your private key and sent to a certificate authority. Decoding it lets you check the domains and key size before you submit it.