Does a CSR contain my private key?

No. It contains only the public key and a signature made with the private key. The private key never leaves the machine that generated it — and should never be pasted into any online tool.

Can I edit a CSR to add a missing SAN?

No. Any change invalidates the self-signature. Generate a new CSR with the correct names; you can keep the same private key if you wish.

Is it safe to share a CSR?

Yes. A CSR is public information — you send it to a certificate authority by definition. It reveals only the identity you're requesting and your public key.

CSR Decoder

Decode a Certificate Signing Request and check its subject, SANs and key before submitting it.

on the roadmapSecurity, PKI & Cryptofree · no sign-up

This bench is being wired up

The csr-decoder decoder is on the roadmap. The heavier binary and cryptographic parsers ship after the core text and token decoders — all of which are already live and working.

Browse the live decoders

Input is processed on your device. Nothing you paste is sent anywhere.

What is the CSR Decoder?

A CSR decoder parses a PKCS#10 Certificate Signing Request to display the subject, requested Subject Alternative Names, public key size and signature algorithm that a certificate authority will see when issuing a certificate.

A CSR is the request you generate before a certificate exists. It contains the subject you are asking for, the public key half of your key pair, any requested extensions (SANs above all), and a self-signature proving you hold the matching private key. The CA validates the request, then issues a certificate binding that key to a verified identity.

Checking a CSR before submission saves real time. Reissuance is slow, and the mistakes are always the same: a missing SAN, a typo in the organisation or country field, an RSA key below the CA's minimum size, or a SHA-1 signature that modern CAs reject outright. All of them are visible in thirty seconds of reading the decoded request.

CSR Decoder at a glance

Standard: PKCS#10 · RFC 2986
PEM header: -----BEGIN CERTIFICATE REQUEST-----
Contains: Subject, public key, requested extensions, self-signature
Never contains: Your private key

How to use the CSR Decoder

1Paste the CSR including its BEGIN and END CERTIFICATE REQUEST lines.
2Verify the subject fields and, most importantly, the SAN list.
3Confirm the key type and size meet your CA's requirements before submitting.

When you would reach for it

Double-checking a CSR before paying for and waiting on certificate issuance.
Confirming a CSR generated by an appliance or load balancer requests the right names.
Diagnosing a CA rejection without a round trip to support.

CSR Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools