# ASN.1 & OID Decoder

> Walk an ASN.1 DER structure tag by tag and resolve the object identifiers (OIDs) inside it.

- Page: https://decoder.tools/asn1-decoder
- Category: Security, PKI & Crypto
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

An ASN.1 decoder walks a DER-encoded structure (the binary format under certificates, keys, CSRs and many telecom protocols) and shows each element's tag, length and value. It also translates object identifiers such as `1.2.840.113549.1.1.11` into names like `sha256WithRSAEncryption`.

## Example

A DER structure is shown as an indented tree with OIDs named:

```text
SEQUENCE
  SEQUENCE
    OBJECT IDENTIFIER sha256WithRSA (1.2.840.113549.1.1.11)
    NULL
  …
```

Paste a certificate, a public key or any DER blob and every tag is decoded down to the leaves.

## How DER encoding works

DER (Distinguished Encoding Rules, ITU-T X.690) encodes every value as **tag, length, value** (TLV):

- **Tag**, 1 byte for common types: `30` SEQUENCE, `31` SET, `02` INTEGER, `03` BIT STRING, `04` OCTET STRING, `05` NULL, `06` OBJECT IDENTIFIER, `0c` UTF8String, `13` PrintableString, `17` UTCTime, `a0`–`a3` context-specific tags.
- **Length**: one byte if under 128. Otherwise `81` or `82` followed by 1 or 2 length bytes. So `30 82 03 a1` is a SEQUENCE of 929 bytes, the typical start of a certificate.
- **Value**: the content, which for SEQUENCE and SET is more TLVs nested inside.

## Common OIDs

| OID | Name |
|---|---|
| `1.2.840.113549.1.1.1` | rsaEncryption |
| `1.2.840.113549.1.1.11` | sha256WithRSAEncryption |
| `1.2.840.10045.2.1` | ecPublicKey |
| `1.2.840.10045.3.1.7` | prime256v1 (P-256) |
| `1.3.101.112` | Ed25519 |
| `2.5.4.3` | commonName (CN) |
| `2.5.29.17` | subjectAltName |
| `2.5.29.19` | basicConstraints |

## How to use the ASN.1 decoder

1. Paste DER as hex or Base64, a `-----BEGIN-----` PEM block, or open a `.der` file.
2. Read the indented tag-length-value tree, with OBJECT IDENTIFIERs resolved to names.
3. Any bytes left after the structure are flagged.

`openssl asn1parse` prints a similar tree with byte offsets:

```sh Command line
openssl asn1parse -in cert.pem            # PEM input
openssl asn1parse -inform der -in cert.der
openssl asn1parse -in cert.pem -i         # indent nested structures
```

## At a glance

| | |
|---|---|
| Standards | ITU-T X.680 (ASN.1), X.690 (BER/DER/CER) |
| DER | Canonical subset of BER: exactly one encoding per value |
| Certificate start | `30 82 …` (a long SEQUENCE) |
| OID registry | oid-base.com, IANA and the issuing standards bodies |

## FAQ

### What is the difference between BER and DER?

BER allows several encodings of the same value, for example indefinite lengths. DER allows exactly one, which is required anywhere a signature is computed over the bytes, as in certificates.

### Why do certificates start with MII in Base64?

`MII` is the Base64 of `30 82`, a SEQUENCE with a two-byte length. Almost every certificate and key between 256 bytes and 64 KB starts that way.

### How do I decode an OID by hand?

The first byte encodes the first two numbers as `40 × first + second`, so `2a` is `1.2`. Each following number is base-128, with the high bit meaning "more bytes follow": `86 48` is `840`.