Paste a certificate, CSR, or key below. A hand-written ASN.1 parser decodes every X.509 field right in your browser — subject, issuer, SAN, expiry, key usage, fingerprints — plus CSR decoding, private-key match checking, and chain order validation. Nothing is uploaded anywhere.
Every field is parsed from the raw DER bytes by a purpose-built ASN.1 parser — no libraries, no server round-trips:
Version, serial number, signature algorithm, issuer & subject distinguished names (CN, O, OU, C, ST, L, email), validity window with expiry badge, public key (RSA modulus/exponent or EC curve + point, key size with weak-key flag), SHA-256 & SHA-1 fingerprints, and all extensions: Subject Alternative Names (DNS/IP/email/URI), Key Usage, Extended Key Usage, Basic Constraints, Subject/Authority Key Identifiers, CRL Distribution Points, Authority Information Access, Certificate Policies.
Subject, public key, signature algorithm, and attributes — including the extensionRequest attribute that carries requested SANs. Useful to verify a CSR contains the right domains before paying a CA to sign it.
openssl x509 -in cert.pem -text -noout
openssl req -in request.csr -text -noout
openssl x509 -in cert.pem -noout -dates
openssl x509 -noout -modulus -in cert.pem | openssl md5 openssl rsa -noout -modulus -in key.pem | openssl md5 # identical hashes = matching pair
openssl s_client -connect example.com:443 -showcerts </dev/null | \
awk '/BEGIN CERT/{p=1} p; /END CERT/{p=0}' > chain.pem
Paste chain.pem into the Chain Check tab to validate its order.
| Feature | This tool | SSLShopper decoder | DigiCert checker |
|---|---|---|---|
| Certificate (X.509) decode | ✓ full field breakdown | ✓ basic | ✓ basic |
| CSR decode | ✓ incl. extensionRequest SANs | — | ✓ |
| Private-key match check | ✓ PKCS#1 / PKCS#8 / SEC1 EC | — | — |
| Chain order validation | ✓ | — | — |
| Expiry badge (expired / <30 days) | ✓ | — | — |
| Full extension list (SAN, KU, EKU, AIA, CRL…) | ✓ | partial | partial |
| 100% client-side (nothing uploaded) | ✓ verifiable in DevTools | server-side | server-side |
Feature comparison based on publicly observable behavior of the named tools, October 2026. Names belong to their respective owners.
Paste the PEM text of the certificate (starting with -----BEGIN CERTIFICATE-----) into the decoder above. It parses the ASN.1/DER structure entirely in your browser and shows every X.509 field: subject, issuer, serial number, validity dates, public key details, subject alternative names (SAN), key usage, extended key usage, and SHA-256/SHA-1 fingerprints. On Linux you can also run: openssl x509 -in cert.pem -text -noout.
A CSR (Certificate Signing Request) is the PKCS#10 file you send to a Certificate Authority to get a certificate. It contains your public key and the subject details, plus requested extensions like SANs. Paste the PEM text (-----BEGIN CERTIFICATE REQUEST-----) into the CSR tab above to decode it — subject, public key, signature algorithm, and any requested extensions — without installing anything.
A private key matches a certificate when its RSA modulus (or EC public point) is identical to the one in the certificate. Use the Key Match tab above: paste the certificate PEM and the private key PEM (PKCS#1, PKCS#8 or SEC1 EC). The comparison runs 100% in your browser — the key is never uploaded anywhere.
On Linux or macOS with OpenSSL installed, run: openssl req -in request.csr -text -noout. On Windows, the same command works in Git Bash or WSL. If you have no terminal access, paste the CSR into the CSR tab of this page — it decodes entirely client-side on any OS.
An X.509 certificate contains: version, serial number, signature algorithm, issuer distinguished name, validity period (notBefore/notAfter), subject distinguished name, subject public key info, and extensions — most importantly Subject Alternative Name (SAN), Key Usage, Extended Key Usage, Basic Constraints, Subject/Authority Key Identifiers, CRL distribution points and Authority Information Access URLs.
Paste the certificate into the decoder above — the validity section shows notBefore/notAfter dates with a clear badge: VALID, EXPIRES SOON (under 30 days) or EXPIRED. With OpenSSL: openssl x509 -in cert.pem -noout -dates.
Subject Alternative Names are an X.509 extension listing every hostname (and optionally IP address or email) the certificate is valid for. Modern browsers ignore the subject CN field and validate only against SANs. This decoder lists each SAN entry with its type (DNS, IP, email, URI).
A chain file must be ordered leaf first, then intermediates, root last. Paste all PEM blocks into the Chain tab above — it checks that each certificate's issuer matches the next certificate's subject and flags breaks. Misordered chains are a common cause of "incomplete chain" errors.
Those are older, minimal tools from the early 2010s. This decoder adds CSR decoding, private-key match checking, chain order validation, expiry warnings, full extension breakdown, and a hand-rolled ASN.1 parser that runs 100% client-side — your certificate is never sent to any server.
Certificates and CSRs contain only public information. This tool additionally never uploads anything: all parsing happens in your browser's JavaScript engine (verifiable in DevTools' Network tab). Never paste a private key into any website as a habit; the Key Match tab processes it locally only.
In Chrome, click the padlock/tune icon in the address bar, then Connection is secure → Certificate is valid. In Firefox, click the padlock → Connection secure → More information → View Certificate. Export it as PEM (Base64) and paste it above to analyze.
The key fields: Subject and Issuer, Validity dates, Subject Alternative Names, Signature Algorithm (avoid sha1/md5 — weak), Public-Key size (RSA under 2048 bits is weak), and Basic Constraints (CA:TRUE on a leaf is a red flag). This page presents the same data readably.
Both parse a PKCS#10 CSR and display its contents; "checker" sometimes implies extra validation. This tool decodes the full CSR and additionally verifies private-key matches and chain order, covering both uses.
Yes — this page decodes CSRs entirely in the browser with a hand-written ASN.1 parser. No downloads, works on Windows, macOS, Linux, and phones.
DER is the raw binary ASN.1 encoding. PEM is the same bytes in Base64 with -----BEGIN CERTIFICATE----- header lines. This decoder accepts PEM; convert DER with: openssl x509 -inform der -in cert.cer -out cert.pem.
Free tool by NRTechStudio
Explore similar security tools and calculators. 100% free, accurate, and runs completely in your browser without sign-up.
2 taps, no typing needed — diagnostics are sent automatically.