X.509 Certificate Decoder
Decode X.509 certificates. Subject, issuer, validity, extensions, thumbprints. Nothing is uploaded.
Decode X.509 certificates online. Shows subject, issuer, validity, key info, extensions, and SHA-256 thumbprint. Runs in your browser. Read more Show less
What is an X.509 certificate?
An X.509 certificate is a signed statement that binds a public key to an identity. It is the foundation of TLS, code signing, S/MIME email encryption, client authentication, and most of the public-key infrastructure the internet depends on. Every time you visit an HTTPS website, your browser is checking the server's X.509 certificate against a chain of trust that ultimately terminates at a root CA embedded in your operating system or browser.
A certificate contains:
- Subject - who the certificate identifies.
- Issuer - who signed it (usually a CA).
- Validity period - notBefore and notAfter dates.
- Public key - the key being certified.
- Serial number - unique within the issuing CA.
- Signature - the CA's cryptographic proof.
- Extensions - additional metadata: subject alternative names, key usage, certificate policies, revocation endpoints, and so on.
The structure is defined by ITU-T X.509 and encoded in ASN.1/DER. The file you are looking at when you open a .crt or .pem file is that DER structure, usually wrapped in base64 with -----BEGIN CERTIFICATE----- headers.
How to use
Paste a PEM certificate or its base64-encoded DER body. The tool parses the structure and shows three views:
- Summary - a human-readable breakdown of the fields, extensions, and thumbprints.
- JSON - a structured object suitable for scripting or inspection.
- PEM - the certificate re-encoded with consistent line wrapping, useful for pasting into config files.
The tool also verifies the certificate's own signature when the issuer key is present in the same certificate (self-signed certs). For chain verification, use openssl verify or your platform's trust store tooling.
What the summary shows
Subject and Issuer are shown as RFC 4514 distinguished names. The most common RDNs are: CN (common name), O (organization), OU (organizational unit), C (country), ST (state), L (locality), and emailAddress.
Serial number is shown in hexadecimal, which is what CAs publish in their certificate transparency logs.
Validity period shows notBefore and notAfter with local time and an indicator of whether the certificate is currently valid, expired, or not yet valid.
Public key shows the algorithm (RSA, EC, Ed25519) and, for RSA, the modulus size in bits. For EC, the named curve.
Signature algorithm is what the CA used to sign this certificate. It is independent of the public key algorithm - an RSA key can be signed by an ECDSA CA, and vice versa.
Thumbprints are SHA-1 and SHA-256 digests of the certificate's DER bytes. The SHA-256 thumbprint is the fingerprint browsers and tools display for certificate pinning and manual verification.
Extensions
Extensions are the extensible part of X.509. Each has an object identifier (OID), a critical flag, and a value. The common ones this tool decodes structurally:
- Basic Constraints (2.5.29.19) - whether the certificate is a CA, and the maximum chain depth if so.
- Key Usage (2.5.29.15) - which cryptographic operations the key may perform: digital signature, key encipherment, certificate signing, and so on.
- Extended Key Usage (2.5.29.37) - higher-level purposes: TLS server, TLS client, code signing, email protection, OCSP signing.
- Subject Alternative Name (2.5.29.17) - the hostnames, IP addresses, email addresses, or URIs the certificate is valid for. Since 2017, browsers ignore the CN field entirely and only check SAN.
- Subject Key Identifier (2.5.29.14) and Authority Key Identifier (2.5.29.35) - unique identifiers used to link certificates into chains.
- CRL Distribution Points (2.5.29.31) - URLs where revocation lists can be fetched.
- Authority Information Access (1.3.6.1.5.5.7.1.1) - where to find the issuing certificate and OCSP responder.
- Certificate Policies (2.5.29.32) - policy OIDs that indicate compliance with standards such as the CA/Browser Forum Baseline Requirements.
Unknown extensions are shown with their OID, critical flag, and a hex preview of their value.
What this tool is not
It does not validate the trust chain. It does not check revocation. It does not tell you whether a certificate is "good" - it tells you what the certificate says. Determining whether the certificate is trusted requires the full chain and a trust anchor, which this tool does not do.
It also does not modify certificates. It parses and re-encodes. If you need to generate, sign, or convert certificates, use openssl or a CA management tool.
FAQ
Why does the summary not show a CN?
Because the certificate might not have one. Since 2017 the CA/Browser Forum requires that server certificates put hostnames in the Subject Alternative Name extension, and browsers ignore the CN entirely. Some modern certificates omit the CN from the subject altogether.
Why is my certificate showing as expired?
Check the notAfter date carefully. Certificates use UTC. Also note that a certificate can be valid per its own dates but still be rejected by browsers because of its chain, revocation status, or the CA/Browser Forum's 398-day maximum lifetime rule.
What is the difference between a PEM certificate and a DER certificate?
PEM is base64 text with -----BEGIN CERTIFICATE----- headers. DER is the same bytes without the base64 wrapper. A PEM file is roughly 1.37 times the size of the equivalent DER file. This tool accepts both.
What does "critical" mean on an extension?
It means that a consumer of the certificate must understand and process the extension, or reject the certificate. Non-critical extensions can be ignored by consumers that do not understand them. Misusing the critical flag is a common source of certificate rejection errors.
Can I use this to decode client certificates?
Yes. Client certificates are structurally identical to server certificates. The only differences are in the extensions (client certificates usually have the clientAuth extended key usage and no subjectAltName).
What is a wildcard certificate?
A certificate with a SAN entry like *.example.com. It is valid for www.example.com, api.example.com, and so on, but not for example.com itself (the bare domain is not covered by a wildcard match in modern implementations). The tool shows wildcard SANs exactly as they appear.
Can this tool verify the signature?
For self-signed certificates, yes. For CA-issued certificates, verification requires the issuer's public key, which is not usually in the same file. Use openssl verify -CAfile ca.pem cert.pem for full chain verification.
Command line equivalent
# Display certificate fields (openssl)
openssl x509 -in cert.pem -noout -text
# Extract just the subject
openssl x509 -in cert.pem -noout -subject
# Extract the SHA-256 fingerprint
openssl x509 -in cert.pem -noout -fingerprint -sha256
# Convert PEM to DER
openssl x509 -in cert.pem -outform DER -out cert.der
# Convert DER to PEM
openssl x509 -in cert.der -inform DER -out cert.pem
# Verify a certificate against a CA bundle
openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt cert.pem
# Extract the public key from a certificate
openssl x509 -in cert.pem -pubkey -noout
# Fetch a server's certificate chain (openssl s_client)
echo | openssl s_client -connect example.com:443 -showcerts 2>/dev/null
# Node (using @peculiar/x509)
node -e '
const fs = require("fs");
require("reflect-metadata");
import("@peculiar/x509").then(({ X509Certificate }) => {
const pem = fs.readFileSync("cert.pem", "utf8");
const cert = new X509Certificate(pem);
console.log("Subject:", cert.subject);
console.log("Issuer: ", cert.issuer);
console.log("Valid: ", cert.notBefore.toISOString(), "->", cert.notAfter.toISOString());
});
'