📜 X.509 Certificate Decoder (PEM)
Paste a PEM certificate to see who it's for, who issued it, when it expires, its key and its SAN domains — parsed locally on your device.
Paste a PEM certificate (the -----BEGIN CERTIFICATE----- block) to read its subject, issuer, validity window, key and extensions. The tool parses the ASN.1/DER structure directly in your browser — the certificate is never uploaded. Certificates are public by design, but decoding locally means even an internal cert stays on your machine. 🔒 100% client-side.
How the x.509 certificate decoder (pem) works
An X.509 certificate is a binary ASN.1/DER structure wrapped in Base64 between -----BEGIN CERTIFICATE----- lines (the PEM format). This tool Base64-decodes the block to raw DER bytes and walks the ASN.1 tree itself — no server, no library upload — to pull out the fields: version and serial number, the signature algorithm, the issuer and subject distinguished names, the notBefore / notAfter validity window, the public-key algorithm and size (RSA bit length or EC curve), and the standard extensions including Subject Alternative Names, key usage, extended key usage and basic constraints. It then compares the validity dates to now and tells you whether the certificate is currently valid, not yet valid, or expired.
This is handy for checking exactly what a certificate covers — which hostnames are in its SAN list, when it expires, whether it's a CA — without trusting an online decoder with it. Certificates are public by design (they're sent in the clear during every TLS handshake), so decoding one isn't sensitive, but doing it locally means an internal or not-yet-deployed certificate never leaves your machine. It decodes the certificate only; it does not verify the signature, check revocation, or validate the chain to a trusted root — those require the issuer's key and live network checks. Paste a single certificate; for a full chain, decode each block in turn.
Frequently asked questions
How do I decode a PEM certificate?
Copy the block that starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE----- (or load a .pem/.crt file) and paste it in. The tool shows the subject, issuer, validity dates, public key and extensions immediately.
What do notBefore and notAfter mean?
They are the start and end of the certificate's validity window. The certificate is only trusted between those two UTC timestamps; the tool compares them to the current time and labels the certificate valid, not-yet-valid or expired, and shows how many days remain.
What are Subject Alternative Names (SANs)?
The SAN extension lists every hostname (and sometimes IP) the certificate is valid for. Modern browsers use the SAN list, not the Common Name, to decide whether a certificate matches a site — so if a domain isn't in the SAN list, it won't be trusted for that domain.
Does this verify the certificate or just decode it?
It decodes only. It reads and displays the certificate's contents but does not check the signature, the revocation status (CRL/OCSP), or whether it chains to a trusted root — those need the issuer's public key and network access. Use it to inspect fields, not to prove trust.
Is the certificate uploaded anywhere?
No — the ASN.1/DER parsing runs entirely in your browser and nothing is transmitted, so even an internal or pre-deployment certificate stays on your device. It works offline too.
Can I paste raw Base64 or DER hex instead of a PEM block?
Yes. If you paste the Base64 body without the BEGIN/END lines, or the DER bytes as hex, the tool detects the format and decodes it the same way.