What is an SSL/TLS certificate?

An SSL/TLS certificate is a digital document that binds a cryptographic key to a domain name, enabling HTTPS through authentication and encryption. It follows the X.509 standard and contains the subject, issuer, validity period, public key, and signature algorithm.

Is it safe to paste production certificates here?

Yes. This tool runs 100% client-side — there are no API calls, no server processing, and no logging. Certificates are public data sent in cleartext during every TLS handshake, and private keys are never part of a certificate.

What is a certificate chain and why does it matter?

A certificate chain is the sequence from your leaf certificate through intermediate CAs to a trusted root. If an intermediate is missing or expired, browsers show trust errors even when the leaf certificate itself is valid. This tool visualizes the entire chain.

What are Subject Alternative Names (SANs)?

SANs are an X.509 extension that lists all valid hostnames and IP addresses covered by the certificate. Modern browsers require SANs and ignore the legacy Common Name field. SANs support multi-domain certificates and wildcard entries like *.example.com.

How does the URL check mode work?

The tool establishes a real TLS connection to the target domain and extracts the certificate chain from the handshake. It captures the TLS protocol version, cipher suite, key exchange algorithm, ALPN protocol (HTTP/2), trust status, chain depth, and handshake timing in milliseconds.

Security & Auth

Certificate Decoder

Decode and inspect SSL/TLS certificates: view certificate chains, expiry dates, SANs, fingerprints, and key details. 100% client-side.

Open tool

Quick reference

Category: Security & Auth
Runs in: Browser
Data stored: Nothing
Price: Free
Sign-up: Not needed

Browse categories

All features

PEM certificate decoding
Live SSL/TLS certificate checking
Certificate chain visualization
SSL security checks
Subject Alternative Names inspection
SHA-256 and SHA-1 fingerprint computation
Side-by-side certificate comparison
CSR reading and generation (PKCS#10)

What you can do

Decode a PEM certificate

Paste a PEM-encoded X.509 certificate to instantly see its subject, issuer, validity period, public key, and signature algorithm.

Inspect a live SSL/TLS endpoint

Enter a domain URL and the tool establishes a TLS connection, extracts the full certificate chain, and reports protocol version, cipher suite, and handshake timing.

Verify the certificate chain

Visualize the trust path from the leaf certificate through intermediate CAs to the trusted root, with validity periods and key algorithms for each.

Compare two certificates

Paste two PEM certificates or check two live URLs to see a structured diff showing matches and differences across all fields — useful for renewal verification.

Read a CSR

Paste a PKCS#10 Certificate Signing Request to decode its subject, public key details, SANs, and signature — verify before submitting to a CA.

Generate a CSR

Fill in subject details, choose RSA/EC/Ed25519 key type, generate a key pair, and produce a signed CSR ready to submit to a Certificate Authority.