SSL Certificate Decoder & Viewer
Decode a PEM certificate or CSR in the browser. Free, and runs entirely in your browser — nothing you enter is uploaded, stored or sent to a server.
About Certificate Viewer
Paste a PEM certificate or a certificate signing request and it is parsed here in the browser: subject, issuer, validity, serial, public key algorithm and size, subject alternative names and the key extensions. Nothing is uploaded, which matters when you are inspecting a certificate for an internal service.
The usual moment to reach for it is after a CA emails you a bundle and before you deploy it — confirming the common name, the SAN list and the validity window is far cheaper than discovering the mismatch in production.
Paste the whole bundle rather than one block and every certificate in it is drawn as a tree, in the order the file has them, so a bundle assembled in the wrong order or missing its intermediate shows up before it reaches a server.
Where it helps
- Runs entirely offline, so internal and pre-production certificates stay private.
- Handles both certificates and CSRs, which is what you have during issuance.
- Shows the full SAN list, where most hostname mismatches are explained.
- Works on a certificate that is not deployed anywhere yet.
Limits
- It reads what you paste — it cannot say whether that certificate is the one a server is serving.
- PEM input only: DER or PKCS#12 must be converted first, for example with
openssl x509 -inform der. - It does not verify signatures, check revocation, or build a trust path.
- Exotic or private extensions are shown in raw form rather than being fully decoded.
Frequently asked questions
What is the difference between this and the SSL Checker?
This decodes a certificate you already have, in your browser. The SSL Checker connects to a live host to see what it serves.
My certificate is a .crt, .cer or .pem file. Which works?
Any of them if the contents are Base64 between -----BEGIN CERTIFICATE----- markers. Binary DER files need converting first.
Can I paste a whole bundle?
Paste one certificate at a time. For a full chain as served, use the Certificate Chain Validator.
Is my private key needed?
Never. Certificates and CSRs contain only public information — do not paste a private key into any tool.
Related tools
- CSR Generator — Generate a key pair and certificate signing request locally
- SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
- Certificate Chain Validator — Walk the served chain and flag ordering and trust problems
- Certificate Expiry Checker — Check expiry dates for up to ten hosts at once
- OpenSSL Helper — Build the command, read one somebody sent you, and check a key against its certificate
- Self-Signed Certificate Generator — Create a certificate and key for local HTTPS, or a private CA to sign development certificates
More SSL & Certificates tools
- SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
- Certificate Chain Validator — Walk the served chain and flag ordering and trust problems
- Certificate Expiry Checker — Check expiry dates for up to ten hosts at once
- OpenSSL Helper — Build the command, read one somebody sent you, and check a key against its certificate
- CSR Generator — Generate a key pair and certificate signing request locally
- Self-Signed Certificate Generator — Create a certificate and key for local HTTPS, or a private CA to sign development certificates
- Certificate Converter — Convert certificates between PEM, DER and Base64, unpack .p7b bundles, and put a chain in order
- Certificate Transparency Search — Every certificate public CAs have issued for a domain, the subdomains they reveal, and what is about to expire