Certificate Decoder

Decode PEM or DER certificates locally. Free, private, runs in your browser.

100% private — your files and text never leave your browser. All processing happens locally on your device.

Certificate PEM or Base64 DER

Paste a PEM certificate, paste base64 DER, or upload a DER certificate to decode locally.

You might also need

CSR GeneratorCreate certificate signing requests locally

RSA Key GeneratorGenerate RSA key pairs locally with Web Crypto

SSL CheckerQuick TLS health check: cert issuer, expiry, SANs, HSTS

JWT DecoderDecode and verify JWT tokens with color-coded display

Decode X.509 Fields Offline

Certificate Decoder reads PEM chains, base64 DER, or uploaded DER certificates locally. It shows subject, issuer, serial number, validity dates, algorithms, SANs, and fingerprints.

Fingerprint Calculation

SHA-256 and SHA-1 fingerprints are calculated over the certificate DER bytes with Web Crypto. This is useful for comparing certificates, documenting rotations, or checking local fixtures.

Not A Trust Checker

The decoder does not verify certificate chains, revocation, CT logs, hostname matches, or live server configuration. Use it for offline inspection, then use a full TLS audit when trust matters.

FAQ

Does Certificate Decoder verify trust?

No. It decodes certificate fields and fingerprints locally. It does not validate chains, revocation, CT logs, or live host configuration.

Can I decode a chain file?

Yes. Paste a PEM chain with multiple certificates and each certificate is decoded separately.

Are fingerprints calculated locally?

Yes. SHA-256 and SHA-1 fingerprints are calculated over the certificate DER bytes in the browser.

Does it support DER uploads?

Yes. Upload .der, .cer, or .crt files; binary DER files are read locally as ArrayBuffer.

Is my certificate uploaded?

No. PEM/DER content stays in the browser.