About this tool
Inspect bounded certificate evidence before deployment or troubleshooting while keeping supplied-chain signatures separate from trust, hostname, and revocation claims.
X.509 Certificate Decoder parses PEM and DER certificate structures in the browser and exposes identity, validity, algorithm, extension, key-usage, SAN, and SHA-256 fingerprint data without initiating a network connection.
- Accepts strict CERTIFICATE PEM blocks or one exact DER sequence, rejects outside text and trailing bytes, and limits certificate, extension, and SAN counts.
- Shows subject, issuer, serial number, validity, SANs, usages, algorithms, key size, constraints, extensions, and deterministic validity or legacy-crypto findings.
- Computes SHA-256 fingerprints, verifies issuer signatures only when matching certificates are supplied, and exports a versioned scope-limited JSON report.
How to use Certificate Decoder
Choose a certificate file or paste a PEM block, decode it, select a certificate when the input contains a chain, compare fields and fingerprints, and download JSON when the inspection must be recorded.
When this tool is useful
- Before installing a certificate or sharing its fingerprint.
- When debugging SAN, issuer, key usage, or expiration mismatches.
- When documenting the certificates included in a PEM chain.
Practical tips
- Compare SHA-256 fingerprints through a separate trusted channel.
- A valid date range does not prove hostname or chain trust.
- Use an online-status or platform trust check separately when revocation and trust anchors matter.
Examples you can test
Load an example, compare the result with the expected output, then replace it with your own input.
Inspect a TLS leaf certificate
Example input
server.crt in PEM format
Expected output
Subject, issuer, SANs, validity, algorithms, key usages, and SHA-256 fingerprint
The decoded values still need hostname and trust-chain validation.
Validation checklist
- Confirm the selected chain certificate.
- Review SANs and validity dates.
- Compare the SHA-256 fingerprint.
- Do not interpret decoding as trust or revocation validation.