decoder.tools

ASN.1 & OID Decoder

Walk an ASN.1 DER structure tag by tag and resolve the object identifiers (OIDs) inside it.

Security, PKI & CryptoFree
INPUT

Or drop a file here: a DER / BER file

OUTPUT

The result appears here as you type.

Decoding runs in your browser. What you paste is not sent to a server.

An ASN.1 decoder walks a DER-encoded structure (the binary format under certificates, keys, CSRs and many telecom protocols) and shows each element's tag, length and value. It also translates object identifiers such as 1.2.840.113549.1.1.11 into names like sha256WithRSAEncryption.

Example

A DER structure is shown as an indented tree with OIDs named:

SEQUENCE
  SEQUENCE
    OBJECT IDENTIFIER sha256WithRSA (1.2.840.113549.1.1.11)
    NULL
  …

Paste a certificate, a public key or any DER blob and every tag is decoded down to the leaves.

How DER encoding works

DER (Distinguished Encoding Rules, ITU-T X.690) encodes every value as tag, length, value (TLV):

  • Tag, 1 byte for common types: 30 SEQUENCE, 31 SET, 02 INTEGER, 03 BIT STRING, 04 OCTET STRING, 05 NULL, 06 OBJECT IDENTIFIER, 0c UTF8String, 13 PrintableString, 17 UTCTime, a0–a3 context-specific tags.
  • Length: one byte if under 128. Otherwise 81 or 82 followed by 1 or 2 length bytes. So 30 82 03 a1 is a SEQUENCE of 929 bytes, the typical start of a certificate.
  • Value: the content, which for SEQUENCE and SET is more TLVs nested inside.

Common OIDs

OIDName
1.2.840.113549.1.1.1rsaEncryption
1.2.840.113549.1.1.11sha256WithRSAEncryption
1.2.840.10045.2.1ecPublicKey
1.2.840.10045.3.1.7prime256v1 (P-256)
1.3.101.112Ed25519
2.5.4.3commonName (CN)
2.5.29.17subjectAltName
2.5.29.19basicConstraints

How to use the ASN.1 decoder

  1. Paste DER as hex or Base64, a -----BEGIN----- PEM block, or open a .der file.
  2. Read the indented tag-length-value tree, with OBJECT IDENTIFIERs resolved to names.
  3. Any bytes left after the structure are flagged.

openssl asn1parse prints a similar tree with byte offsets:

Command line
openssl asn1parse -in cert.pem            # PEM input
openssl asn1parse -inform der -in cert.der
openssl asn1parse -in cert.pem -i         # indent nested structures

At a glance

StandardsITU-T X.680 (ASN.1), X.690 (BER/DER/CER)
DERCanonical subset of BER: exactly one encoding per value
Certificate start30 82 … (a long SEQUENCE)
OID registryoid-base.com, IANA and the issuing standards bodies

Frequently asked questions

What is the difference between BER and DER?

BER allows several encodings of the same value, for example indefinite lengths. DER allows exactly one, which is required anywhere a signature is computed over the bytes, as in certificates.

Why do certificates start with MII in Base64?

MII is the Base64 of 30 82, a SEQUENCE with a two-byte length. Almost every certificate and key between 256 bytes and 64 KB starts that way.

How do I decode an OID by hand?

The first byte encodes the first two numbers as 40 × first + second, so 2a is 1.2. Each following number is base-128, with the high bit meaning "more bytes follow": 86 48 is 840.

Last reviewed · found a mistake? contact@decoder.tools · view as markdown