x.509 Certificate Decoder
Paste an SSL/TLS certificate in PEM format and see issuer, subject, validity, SAN domains, algorithm and SHA-256 fingerprint. 100% in your browser.
Built by
Miguel Ángel Colorado Marin (MACM)
Built by
Miguel Ángel Colorado Marin (MACM)
Full-Stack Developer · Guadalajara, España
I develop web apps, digital tools and full projects — from design to deployment.
The x.509 certificate decoder lets you parse an SSL/TLS certificate in PEM format and see all its details clearly: issuer, subject, validity period, serial number, signature algorithm, SAN domains and the SHA-256 fingerprint. It's the perfect tool to check who a certificate belongs to, when it expires or which domains it covers before installing or renewing it. It complements the SSL checker and the web analyzer for cybersecurity and infrastructure tasks. Paste the certificate and it's decoded instantly in your browser: the certificate is never uploaded to any server or stored, so you can analyze even internal or sensitive certificates with full privacy.
Features
- ✓Issuer and subject
- ✓Validity dates
- ✓SAN domains
- ✓Signature algorithm
- ✓SHA-256 fingerprint
- ✓100% in browser
How to decode an SSL certificate?
- 1
Copy the PEM certificate
Get the certificate in PEM format (starts with -----BEGIN CERTIFICATE-----). You can export it from the browser or with openssl.
- 2
Paste it into the tool
Paste the full block into the text area. Everything is parsed in your browser, the certificate is never uploaded.
- 3
Decode
Click Decode to see all fields: issuer, subject, validity, SAN, algorithm and fingerprint.
- 4
Check the validity
An indicator shows whether the certificate is valid, how many days remain or if it's expired.
Frequently asked questions
Is my certificate uploaded to a server?
No. The certificate is parsed 100% in your browser with the node-forge library. It never leaves your device, ideal for internal or private certificates.
What is an x.509 certificate?
It's the standard for the digital certificates used in HTTPS/TLS. It contains the public key, the domain, the issuer (CA), the validity dates and extensions like alternative domains (SAN).
What are SAN domains?
Subject Alternative Names: the list of domains and subdomains the certificate covers. A modern certificate usually secures several domains with this extension.
What is the SHA-256 fingerprint for?
It's a unique identifier of the certificate. It's used to verify a certificate is exactly the expected one (pinning) and to compare it with the one a server presents.
Related tools
Embed Certificate Decoder on your site
Add Certificate Decoder to any web page with a simple iframe. Free, with attribution to miguelacm.es.
<iframe
src="https://miguelacm.es/embed/certificate-decoder"
width="100%"
height="700"
frameborder="0"
title="Certificate Decoder — miguelacm.es"
></iframe>