A system administrator hands you a .pem certificate and you need to know if it's valid, which domains it covers, or when it expires, without installing OpenSSL or remembering the exact command (openssl x509 -in cert.pem -text -noout, if that rings a bell). Decoding the certificate in the browser gives you the same information instantly.
What an x.509 certificate is
An x.509 certificate is the standard format HTTPS uses to certify that a public key belongs to a specific domain. It's issued by a certificate authority (CA) and contains, among other things, the domain's identity, the validity period, and the signature of the CA backing it.
It usually comes in PEM format: Base64 text delimited by -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----. That block of text is exactly what you paste into a decoder.
The fields that actually matter
When decoding a certificate, these are the details worth checking:
- Issuer: which certificate authority signed it (Let's Encrypt, DigiCert, etc.).
- Subject: the main domain it was issued for.
- Validity: start and expiration dates. An expired certificate makes the browser show security warnings.
- SAN (Subject Alternative Names): the full list of domains and subdomains the certificate covers. It's common for a certificate to cover several subdomains at once (
www.example.com,api.example.com). - SHA-256 fingerprint: a unique hash of the certificate, useful for verifying two certificates are exactly the same without comparing the whole file.
How to decode a certificate
- Copy the PEM block of the certificate, including the
BEGIN/END CERTIFICATElines. - Paste it into the tool.
- All the fields above are displayed in readable form.
You can do it free with the x.509 certificate decoder on this site, which processes the certificate directly in your browser.
Why checking the SAN is more useful than it seems
The SAN field sometimes reveals more than the team expected: internal subdomains, staging environments, or service names that weren't meant to be public but show up in the certificate because it was issued to cover all of them at once. Reviewing someone else's certificate's SAN is, in fact, a passive reconnaissance technique (related to what a subdomain finder does using Certificate Transparency).
Why decode it in your browser, not on some random site
A certificate itself isn't secret (it's public information anyone receives when connecting to the server), but if you're debugging your own server's configuration, it's reasonable not to depend on a third party to read that file. Decoding it in your browser removes any external dependency: the certificate never leaves your device.
Frequently asked questions
Does the certificate contain the private key? No. An x.509 certificate is the public part; the private key should never be shared or pasted into any tool.
What does "expired" mean? That the current date is outside the certificate's validity range; browsers flag it as not secure even if the rest of the configuration is correct.
Can I decode a certificate in DER format instead of PEM? This tool works with the PEM format (Base64 text); a binary DER would need to be converted to PEM first.
What is the SHA-256 fingerprint for? To verify a certificate is exactly the one you expect, by comparing the fingerprint against one given by a trusted source, without comparing the entire file character by character.
Decode any x.509 certificate free with the certificate decoder, 100% in your browser and without uploading the file to any server.