Decode an X.509 certificate (.pem, .crt, .cer, .der) locally in your browser: issuer, validity, key, SANs and fingerprint. No upload.
Running locally on your device ...
Running locally on your device ...
0%
Your files never left your device
No. Everything runs in your browser - your file never leaves your device. How this is verifiable
An X.509 certificate binds a public key to an identity - a website, an organization, or a certificate authority itself - and is the backbone of TLS/HTTPS, email signing (S/MIME) and code signing. Browsers export it via "view certificate", server operators receive it from their certificate authority, and anyone investigating an expired HTTPS connection or an unexpected certificate chain needs a way to translate the raw ASN.1/DER bytes into readable fields. That is exactly what this tool does.
After you drop it, the tool reads out the issuer, the subject, the serial number, the validity period with an honest status classification (valid, expired, not yet valid, or expiring soon), the signature algorithm, the public-key algorithm and size (the RSA bit length or the ECDSA curve in use), the Subject Alternative Names (the domain names/IPs the certificate actually covers), Basic Constraints (whether it is a CA certificate), Key Usage and Extended Key Usage, and the SHA-1 and SHA-256 fingerprints - all collected into a single, readable text report.
Both the text-based PEM format (Base64 between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----) and the binary DER format that .crt/.cer/.der files often carry are supported - the tool auto-detects either. Several dropped certificates produce several reports, handy for checking an entire certificate chain file by file.
Honestly framed: this is a pure decoder, not a validator. The tool does not build a trust chain to a root CA, does not check revocation status (CRL/OCSP), and does not judge whether an issuer is trustworthy - it only reads out what the certificate itself states. Everything runs entirely locally in the browser via the @peculiar/x509 2.0.0 library (real ASN.1/DER parsing, not a hand-rolled byte interpretation); the certificate never leaves your device.
| Input formats | PEM, CRT, CER, DER |
|---|---|
| Output format | TXT |
| Batch processing | Yes |
| Processing | Locally in your browser (JavaScript) |
| File upload | None |
Limitations: Pure decoding: the tool does NOT build a trust chain to a root CA and does NOT check revocation status (CRL/OCSP) - it says nothing about whether a certificate is actually trustworthy. For a PEM file holding several certificates (a chain), only the first is analyzed; drop the others individually to check them. No private key is ever involved - for generating a new key/CSR, use the separate CSR generator tool.
No. Decoding runs entirely locally in your browser; the certificate never leaves your device and is not stored.
No. It is a pure decoder, not a validator - it does not build a trust chain to a root CA and does not check revocation status.
PEM (text-based, Base64) and DER (binary) - the tool auto-detects either, regardless of whether the file is named .pem, .crt, .cer or .der.
The SHA-1 resp. SHA-256 fingerprint is a hash over the entire certificate bytes - handy for uniquely matching a certificate against a known value.
No. A revocation check (CRL/OCSP) needs a live query against the certificate authority, which this local tool deliberately never performs.
Yes. Drop several files at once, you get one report per certificate.
CSR Generator · Decode JWT · Generate PGP key pair · Calculate an HMAC