Paste a PEM certificate to see its subject, issuer, validity dates, subject alternative names, key details, fingerprints and extensions in plain view.
Runs entirely in your browser. Nothing you put in here gets uploaded.
Accepts one or more PEM blocks (a full chain), a PKCS#10 CSR, or bare base64 or hex DER.
This tool decodes an X.509 certificate and shows every field in plain view: subject and issuer with each attribute spelled out, the validity window with a clear valid or expired verdict and the days remaining, subject alternative names, serial number, public key details, key usages, basic constraints and the SHA-256 and SHA-1 fingerprints.
Paste a single certificate, a whole chain or a PKCS#10 certificate request. A chain decodes into one card per certificate in order, so you can follow a leaf up to its root. Base64 or hex DER without the PEM armor works too, and every value has its own copy button.
Each certificate shows its subject and issuer with every attribute labeled (common name, organization, country and so on), the notBefore and notAfter dates in UTC and local time, all subject alternative names, the serial number, the X.509 version, the public key (RSA modulus size and exponent, or the EC curve), the signature algorithm, key usages, extended key usages, basic constraints and the subject and authority key identifiers. Extensions the tool has no dedicated field for are listed by name and OID, with critical ones flagged.
PKCS#10 certificate requests decode too: the requested subject, key details and requested subject alternative names, plus a check that the request's own signature verifies.
The input can hold several PEM blocks at once, so pasting a fullchain.pem just works. Private key blocks mixed into the file are ignored, never decoded. Without PEM armor the tool also accepts a certificate's raw DER as base64 or hex.
The tool reads certificates, it does not validate chains. It tells you whether a certificate is expired and what it claims about itself, but it does not verify signatures against issuers, check revocation or build a trust path.
Open source does the heavy lifting in this tool. Thank you to:
An X.509 certificate library built on the Web Crypto API.
Everything this site builds on is listed on the credits page.
Tools that share a tag with this one.
Hash a password with bcrypt or Argon2 and verify a password against an existing hash. Tune the cost factor, memory, iterations and parallelism, see how long the hash takes, and read the parsed parts of any hash you paste.
Verify a checksum online: drop a file, paste the expected checksum and see instantly whether they match. The hash type is detected from the checksum itself, covering MD5, SHA-1, SHA-256, SHA-512, BLAKE3, CRC-32 and more, and sha256sum lines or whole checksum files can be pasted as-is.
Paste raw email headers to trace the Received chain hop by hop with per-hop delays, read the SPF, DKIM and DMARC results, and see every header explained. Helps you spot spoofing and find where a slow email got stuck.
Hash text or a file with MD5, SHA-1, SHA-256, SHA-512, SHA-3, BLAKE2, BLAKE3, CRC32 and more, all computed live as you type. Compare against an expected checksum and copy any digest.
Reveal the characters you can't see in a text: zero-width spaces, non-breaking spaces, bidi marks, control characters and CRLF versus LF line endings. Inspect every occurrence and clean them out with a click.
Paste a JSON Web Token to see its header and payload as formatted JSON, with the token color coded so each part maps to its output. Explains the registered claims, shows expiry as readable dates, flags expired tokens and can verify the signature with a secret or public key.