How do I use this PEM certificate decoder?

Paste a -----BEGIN CERTIFICATE----- block (or click Load sample). The page shows subject, issuer, validity, SANs, and fingerprints immediately. Nothing is uploaded.

What is a PEM certificate?

PEM is a Base64 encoding of DER-encoded X.509 data between BEGIN CERTIFICATE and END CERTIFICATE markers. It is the common text form for TLS certificates.

Do you check remote SSL expiry?

No. This tool only decodes the PEM you paste. It does not connect to any host, fetch live certificates, or perform OCSP / CRL checks.

Is my certificate uploaded?

No. Decoding runs only in this tab. The PEM never leaves your browser.

What if I paste a certificate chain?

Only the first BEGIN CERTIFICATE block is decoded (usually the leaf). Paste intermediate or root blocks separately if you need those fields.

Can I paste a private key or CSR?

No. Private keys and certificate requests are rejected. Paste a public certificate PEM only.

How are fingerprints calculated?

SHA-1 and SHA-256 digests of the DER-encoded certificate, shown as uppercase colon-separated hex - the same idea as openssl x509 -fingerprint.

How is this different from openssl x509 -text?

openssl remains the gold standard on servers. This page is a quick local viewer for pasted PEM without installing tools - same fields for subject, issuer, SANs, and fingerprints.

Developer Tools

PEM Certificate Decoder

Paste a PEM-encoded X.509 certificate and read subject, issuer, serial number, validity window, Subject Alternative Names (SANs), SHA-1 / SHA-256 fingerprints, signature…

Decoding runs in your browser. PEM certificates never leave this tab. This tool does not contact remote hosts for SSL expiry.

PEM certificate

Subject

CN=example.com, O=Example Org, C=US

Issuer

CN=Example CA, O=Example Org, C=US

Serial number

Not before

2024-01-01T00:00:00.000Z

Not after

2026-12-31T23:59:59.000Z

Validity (local clock)

Valid now

Subject Alternative Names

DNS: example.com DNS: www.example.com IP: 127.0.0.1

SHA-1 fingerprint

DA:0E:CE:7A:8F:62:7D:F6:D3:9A:C5:28:41:48:02:BA:89:27:94:BE

SHA-256 fingerprint

61:DC:A7:C8:C7:92:3A:B4:D5:CE:25:A0:5F:D7:92:7C:0E:4E:5A:A2:C7:A6:4D:8F:B2:DB:63:E0:10:60:2D:A5

Signature algorithm

sha1WithRSAEncryption

Public key

RSA 1024 bit

X.509 version

About PEM Certificate Decoder

Paste a PEM-encoded X.509 certificate and read subject, issuer, serial number, validity window, Subject Alternative Names (SANs), SHA-1 / SHA-256 fingerprints, signature algorithm, and public key size - entirely in your browser. Nothing is uploaded and this page never contacts a remote host for SSL expiry. Use Load sample to try a demo cert, or paste a leaf from your chain (the first BEGIN CERTIFICATE block is decoded). Pair it with the Base64 Encoder / Decoder when you need to re-wrap DER bytes, or the Hash Generator for other digests.

How to Use PEM Certificate Decoder

Paste a PEM block that starts with -----BEGIN CERTIFICATE----- (or click Load sample).
If you paste a chain, only the first certificate is decoded.
Read subject, issuer, serial, not before / not after, SANs, and fingerprints.
Copy the summary when you need the fields in a ticket or change request.
Everything runs locally - the PEM never leaves this tab.

PEM Certificate Decoder Examples

Leaf TLS certificate

A server leaf PEM shows CN / O / C in subject, the issuing CA in issuer, DNS and IP SANs, and SHA-256 fingerprint for pinning notes.

Validity window check

Not before and not after are shown as ISO timestamps, with a local-clock status (valid now / not yet valid / expired) - no remote SSL probe.

SAN inventory

Subject Alternative Names list DNS names, IPs, emails, and URIs when present so you can confirm hostname coverage.

Fingerprint for docs

SHA-1 and SHA-256 fingerprints are colon-separated uppercase hex, matching common openssl x509 -fingerprint output style.

Reject private keys

BEGIN PRIVATE KEY or CERTIFICATE REQUEST blocks are rejected so you only decode public certificates.

Common Use Cases

Inspect a leaf PEM before installing it on a load balancer
Confirm DNS SANs match the hostnames you expect
Copy SHA-256 fingerprints into runbooks or pin configs
Check not-before / not-after without openssl on the machine
Decode a pasted chain and review the first (leaf) certificate

Frequently Asked Questions about PEM Certificate Decoder

How do I use this PEM certificate decoder?: Paste a -----BEGIN CERTIFICATE----- block (or click Load sample). The page shows subject, issuer, validity, SANs, and fingerprints immediately. Nothing is uploaded.
What is a PEM certificate?: PEM is a Base64 encoding of DER-encoded X.509 data between BEGIN CERTIFICATE and END CERTIFICATE markers. It is the common text form for TLS certificates.
Do you check remote SSL expiry?: No. This tool only decodes the PEM you paste. It does not connect to any host, fetch live certificates, or perform OCSP / CRL checks.
Is my certificate uploaded?: No. Decoding runs only in this tab. The PEM never leaves your browser.
What if I paste a certificate chain?: Only the first BEGIN CERTIFICATE block is decoded (usually the leaf). Paste intermediate or root blocks separately if you need those fields.
Can I paste a private key or CSR?: No. Private keys and certificate requests are rejected. Paste a public certificate PEM only.
How are fingerprints calculated?: SHA-1 and SHA-256 digests of the DER-encoded certificate, shown as uppercase colon-separated hex - the same idea as openssl x509 -fingerprint.
How is this different from openssl x509 -text?: openssl remains the gold standard on servers. This page is a quick local viewer for pasted PEM without installing tools - same fields for subject, issuer, SANs, and fingerprints.

JWT Decoder

Decode JWT header, payload, and signature in your browser. Encode HS256 test tokens on the same page. Free JSON Web Token decoder - nothing uploaded.

Base64 Encoder / Decoder

Free online Base64 encoder and decoder. Encode text to Base64 or decode Base64 back to plain text, with full Unicode (UTF-8) support - runs entirely in your browser.

Hash Generator

Generate SHA-256, SHA-1, SHA-384, and SHA-512 hashes from any text. HMAC lives on the same page. Get the lowercase hex digest instantly in your browser - nothing is uploaded.

User-Agent Parser

Free User-Agent parser in your browser. Paste a UA string to detect browser, OS, device, engine, and bots - nothing is uploaded.