SSL Certificate Decoder
NewPaste a PEM certificate and decode its subject, issuer, validity, and SANs.
SSL certificate decoder
Decode an X.509 PEM certificate
Paste a PEM-encoded certificate to see its subject, issuer, validity, serial number, and Subject Alternative Names. Parsing happens entirely in your browser — nothing is uploaded.
Frequently Asked Questions
Does this verify the certificate chain or check revocation?
No. It only parses the fields inside a single PEM certificate — subject, issuer, validity dates, serial number, algorithms, and SANs. It does not validate trust, check a CA chain, or query OCSP/CRL revocation status.
How is this parsed without a crypto library?
It includes a small hand-written ASN.1 DER parser tailored to the X.509 certificate structure, so it can walk the TBSCertificate fields directly from the decoded bytes without pulling in an external library.
What does the expiry status actually check?
It compares your browser's current time against the certificate's notAfter field and shows either "Expired" or the number of days remaining — it does not check notBefore validity issues beyond parsing the date.
Why do I only see DNS names under Subject Alternative Names?
The parser specifically extracts dNSName entries (GeneralName tag 2) from the SAN extension. Other SAN types like IP addresses or email addresses are part of the spec but are not extracted by this version.
Is my certificate uploaded anywhere?
No. Everything is decoded locally using base64/DER parsing in your browser; nothing is sent over the network.