wyreup
inspect

X.509 Certificate Decoder

Decode a PEM or DER X.509 certificate into a readable JSON report with identity, validity, SAN, key, signature, fingerprint, and self-signed details.

Loading…

About X.509 Certificate Decoder

X.509 Certificate Decoder opens a PEM or DER certificate and shows what's inside: subject, issuer, validity dates with days until expiry, subject alternative names, key and signature algorithms, and SHA-1/SHA-256 fingerprints. It's the quick answer to 'what cert is this and when does it expire?' — decoded locally in your browser, which matters when the cert file is one you'd rather not paste into a random website.

Category
inspect
Input
Accepts: application/x-pem-file, application/pkix-cert, application/x-x509-ca-cert or text/plain.
Output
Outputs: application/json.
Cost
Free, runs in your browser
Memory
low
Privacy: X.509 Certificate Decoder runs entirely on your device. Files you provide never leave your browser — no uploads, no server, no tracking. The page works offline once loaded.

Common uses

  • Check when a TLS certificate expires before it takes production down
  • Verify a certificate's subject alternative names cover every domain you serve
  • Confirm a fingerprint matches what a vendor or CI pipeline expects
  • Inspect an unknown .crt or .pem file someone sent you
  • Tell a self-signed certificate apart from a CA-issued one

Frequently asked questions

What formats does it accept?

PEM (the -----BEGIN CERTIFICATE----- text form) and raw DER binary — .pem, .crt, .cer files, or pasted PEM text.

What does the report include?

Subject, issuer, serial number, validity window with days until expiry, subject alternative names, public-key algorithm and size, signature algorithm, SHA-1 and SHA-256 fingerprints, and whether the cert is self-signed.

Is the certificate sent anywhere?

No. Decoding runs entirely in your browser. Certificates are public by design, but the habit of not pasting infrastructure files into web forms is a good one.

Does it validate the certificate chain?

No — it decodes and reports a single certificate. Chain validation against a trust store is a different job your TLS client or CA tooling does.

Private keys too?

No, and don't paste private keys into anything. This tool reads certificates only.

Keywords

  • x509
  • certificate
  • pem
  • der
  • tls
  • ssl
  • decode
  • inspect
  • fingerprint
  • san

Try next

JWT Decoder
dev

Decode JSON Web Tokens the same local-only way.
Hash
inspect

Fingerprint any file with SHA-256.
JSON Formatter
inspect

Pretty-print the JSON report for sharing.
Color Palette
inspect

Extract dominant colors from an image as hex codes. Transparent pixels are ignored, and large images are downsampled before analysis.
Image Diff
inspect

Pixel-level diff between two images of the same dimensions. Outputs a highlighted diff image plus a JSON stats report.
Image Info
inspect

Extract dimensions, format, and metadata from an image.
PDF Info
inspect

Extract page count and metadata from a PDF.
Hash
inspect

Compute SHA-256, SHA-1, or SHA-512 hashes of files.
JSON Formatter
inspect

Parse and pretty-print JSON with configurable indentation.
Extract PDF Tables
export

Extract tabular data from a PDF as JSON or CSV. Works well for simple tables with aligned columns and no merged cells. Complex tables, rotated text, and scanned PDFs (images) will not extract cleanly.
Topic Keywords
text

Pull the topic-bearing nouns and noun phrases out of any text. Answers "what is this about" — not "what words appear most" (try Text Frequency for that). Runs entirely in your browser.