🛠ToolsHub
🌐

Certificate Decoder

🔒 In your browser

Decode a PEM certificate — subject, SANs, expiry, fingerprints.

How it works

Paste an SSL/TLS certificate (a -----BEGIN CERTIFICATE----- block) to read what's inside it: who it was issued to and by, when it expires, which domains it covers, the key type and its fingerprints.

Get one from a server with: openssl s_client -connect example.com:443 | openssl x509

🔒 Parsed with the Web Crypto API in your browser — the certificate, CSR, and especially your private key are never uploaded.

📝You might also need CSR Decoder →

🔒 Parsed in your browser: certificates, CSRs and private keys are decoded locally with the Web Crypto API and are never sent to a server — unlike most online SSL tools, which ask you to upload them. Still, treat any private key you paste online as sensitive.

About the Certificate Decoder

A PEM certificate is an unreadable block of Base64. This free certificate decoder parses any X.509 certificate and shows its subject, issuer, subject alternative names, validity dates and fingerprints in plain, readable form.

Certificates are parsed in your browser with the Web Crypto API and are never uploaded.

How to decode a certificate

  • Paste the PEM certificate (the -----BEGIN CERTIFICATE----- block).
  • Read the subject, issuer, SANs, validity period and serial number.
  • Check SHA-1 and SHA-256 fingerprints.

What decoding a certificate reveals

  • Subject and issuer — who the certificate is for and who signed it.
  • Validity dates — when it starts and expires.
  • Subject Alternative Names — every hostname it covers.
  • Key details and SHA-1/SHA-256 fingerprints.

Frequently asked questions

What is a PEM certificate?

PEM is a Base64-encoded text format for X.509 certificates, wrapped between BEGIN and END CERTIFICATE lines. This tool decodes it into human-readable fields.

What are subject alternative names (SANs)?

SANs list all the hostnames a certificate is valid for. A single certificate often covers a domain and its www and other subdomains via SANs.

Is my certificate uploaded?

No. Decoding happens locally in your browser and the certificate never leaves your device.

What are Subject Alternative Names (SANs)?

SANs list all the hostnames a certificate is valid for. A single certificate usually covers a domain plus its www and other subdomains via SANs, so checking them confirms the certificate covers the name you expect.

Related searches

certificate decoderdecode ssl certificatex509 decoderpem decoderread certificatessl certificate detailscertificate parser

Learn more

Related Networking tools

SSL Certificate CheckerCSR DecoderCertificate Key MatcherWhat's My IPIP Address Lookup
🔗 Embed this tool on your website — free

Copy this and paste it into your page's HTML. The tool runs in the visitor's browser, just like here. Change height to fit, or add the optional auto-resize snippet below. Add ?theme=dark to the URL for dark mode.

<iframe src="https://toolhq.dev/embed/certificate-decoder/" title="Certificate Decoder — ToolsHub" width="100%" height="520" style="border:1px solid #e5e7eb;border-radius:12px;max-width:680px" loading="lazy"></iframe>
Optional: auto-resize the iframe height

Add this once on the same page so the iframe grows to fit the tool:

<script>
addEventListener("message", function (e) {
  if (e.data && e.data.type === "toolshub:resize") {
    document.querySelectorAll('iframe[src*="/embed/"]').forEach(function (f) {
      if (f.contentWindow === e.source) f.style.height = e.data.height + "px";
    });
  }
});
</script>