CSR Decoder
🔒 In your browserDecode a Certificate Signing Request before you submit it.
How it works
A CSR (Certificate Signing Request) is what you send to a Certificate Authority to get an SSL certificate. Decode it before you submit it — a typo in the domain or a weak key means paying for a certificate you can't use.
Create one with: openssl req -new -key key.pem -out request.csr
🔒 Parsed with the Web Crypto API in your browser — the certificate, CSR, and especially your private key are never uploaded.
🔒 Parsed in your browser: certificates, CSRs and private keys are decoded locally with the Web Crypto API and are never sent to a server — unlike most online SSL tools, which ask you to upload them. Still, treat any private key you paste online as sensitive.
About the CSR Decoder
A Certificate Signing Request (CSR) carries the details a Certificate Authority will put in your certificate. This free CSR decoder lets you check the domains, subject and key size in a CSR before you submit it — so you don't get the wrong certificate issued.
CSRs are parsed in your browser and never uploaded.
How to decode a CSR
- Paste the CSR (the -----BEGIN CERTIFICATE REQUEST----- block).
- Verify the common name, subject alternative names and organisation details.
- Confirm the public key type and size.
What information does a CSR contain?
- Subject / Common Name (CN) — the primary domain the certificate is for, e.g. www.example.com.
- Organization (O) and Organizational Unit (OU) — the company and department requesting it.
- Country (C), State (ST) and Locality (L) — the registered location of the organisation.
- Subject Alternative Names (SAN) — every additional domain the certificate should also cover.
- Public key and key size — the public half of your key pair, typically RSA 2048/4096 or an ECDSA key.
- Signature algorithm — how the request is signed, e.g. SHA-256 with RSA.
Example CSR
A CSR is a Base64 block wrapped in markers: it starts with -----BEGIN CERTIFICATE REQUEST-----, ends with -----END CERTIFICATE REQUEST-----, and has lines of seemingly random characters in between. That opacity is the point — you can't read the details by eye, so you decode it.
Decoding a typical CSR might reveal: Common Name (CN) = www.example.com; Organization (O) = Example Ltd; Country (C) = IN; Subject Alternative Names = example.com, www.example.com; Public key = RSA 2048-bit; Signature algorithm = SHA-256 with RSA. Seeing those fields spelled out is how you confirm the certificate you're about to order is exactly right.
Why check a CSR before submitting it
A Certificate Signing Request encodes the details a Certificate Authority will put in your certificate — the domain, organisation and public key. A typo in the common name, a missing subject alternative name, or a weak key size all become permanent once the certificate is issued, forcing a costly reissue. Decoding the CSR first lets you catch those mistakes while they're still free to fix.
Frequently asked questions
What is a CSR?
A Certificate Signing Request contains your public key and identifying details (like the domain and organisation) that a Certificate Authority uses to issue your certificate.
What information does a CSR contain?
The subject (Common Name and organisation details), any Subject Alternative Names, the public key and its size, and the signature algorithm. It does not contain your private key. The decoder shows all of these in plain text.
What is a SAN in a CSR?
A Subject Alternative Name lists each additional domain the certificate should cover beyond the common name. If a SAN is missing, that domain won't be secured — decoding the CSR lets you confirm every one is present before you submit.
What key size should a CSR use?
RSA 2048-bit is the common minimum today, with 4096-bit for extra strength, or an ECDSA (P-256) key for a smaller, faster alternative. The decoder shows the key type and size so you can confirm it's strong enough.
Why decode a CSR before submitting it?
To catch mistakes — a wrong domain, missing SAN or weak key size — before the CA issues a certificate you'd have to redo.
Is it safe to decode a CSR online?
Yes here — the CSR is parsed locally in your browser and never uploaded. A CSR contains only your public key and identifying details, not your private key, but this tool keeps everything on your device regardless.
Related searches
Learn more
Related Networking tools
🔗 Embed this tool on your website — free
Copy this and paste it into your page's HTML. The tool runs in the visitor's browser, just like here. Change height to fit, or add the optional auto-resize snippet below. Add ?theme=dark to the URL for dark mode.
<iframe src="https://toolhq.dev/embed/csr-decoder/" title="CSR Decoder — ToolsHub" width="100%" height="520" style="border:1px solid #e5e7eb;border-radius:12px;max-width:680px" loading="lazy"></iframe>Optional: auto-resize the iframe height
Add this once on the same page so the iframe grows to fit the tool:
<script>
addEventListener("message", function (e) {
if (e.data && e.data.type === "toolshub:resize") {
document.querySelectorAll('iframe[src*="/embed/"]').forEach(function (f) {
if (f.contentWindow === e.source) f.style.height = e.data.height + "px";
});
}
});
</script>