Certificate Decoder

Decode and inspect X.509 certificates, view certificate chains, check SSL/TLS status, and validate server certificates. 100% client-side.

Features

• PEM certificate parsing and X.509 decoding
• Live SSL/TLS domain inspection
• Certificate chain visualization
• Subject Alternative Names (SAN) display
• SHA-256 and SHA-1 fingerprint computation
• Validity period and expiry checking
• 100% client-side. No data leaves your browser

Frequently Asked Questions

What is an SSL/TLS certificate?

An SSL/TLS certificate is a digital document that binds a cryptographic key to an organization or domain. It enables HTTPS by authenticating the server and encrypting data in transit. Certificates follow the X.509 standard and contain the subject, issuer, validity period, public key, and signature algorithm.

What is PEM format and how do I get a certificate in PEM?

PEM is the most common certificate encoding: Base64-encoded DER wrapped between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----. Export it from your browser padlock icon, via openssl s_client -connect host:443, or from server .pem/.crt files.

Is it safe to paste production certificates here?

Yes. Decoding runs 100% client-side in your browser; there are no API calls for parsing and no server-side storage. SSL certificates are public data sent in cleartext during every TLS handshake, so decoding them exposes no secrets. Private keys are never part of a certificate.

What is a certificate chain?

A certificate chain (chain of trust) runs from the server leaf certificate through intermediate Certificate Authorities up to a trusted root CA. Browsers validate the whole chain; a missing or expired intermediate breaks trust even if the leaf is valid.

What are Subject Alternative Names (SANs)?

SANs are an X.509 extension listing every hostname and IP address a certificate covers. Modern browsers require SANs and ignore the legacy Common Name (CN) field. One certificate can cover multiple domains and wildcard patterns like *.example.com.