# SPIFFE Certificate Decoder

> Extract the spiffe:// identity, trust domain and validity from an X.509-SVID workload certificate.

- Page: https://decoder.tools/spiffe-decoder
- Category: Security, PKI & Crypto
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

A SPIFFE decoder reads an X.509-SVID, the short-lived certificate a workload uses to prove its identity, and extracts the SPIFFE ID (`spiffe://trust-domain/path`) from it.

## Example

An X.509-SVID decodes to its SPIFFE identity and trust domain:

```text
SPIFFE ID:    spiffe://prod.example.com/ns/payments/sa/api
Trust domain: prod.example.com
SVID type:    leaf (workload SVID)
Key:          Ed25519
```

The SPIFFE ID is the single URI in the certificate's Subject Alternative Name extension.

## What is SPIFFE?

SPIFFE (Secure Production Identity Framework for Everyone) is a CNCF standard for giving every workload, such as a pod, VM or process, a cryptographic identity that doesn't depend on network location. The identity is a URI:

```text
spiffe://prod.example.com/ns/payments/sa/api
```

The part after `spiffe://` is the **trust domain**, and the path identifies the workload. Identities are issued as **SVIDs** (SPIFFE Verifiable Identity Documents), either as X.509 certificates or as JWTs. SPIRE is the reference implementation, and service meshes such as Istio and Linkerd use the same model for mutual TLS.

In an **X.509-SVID**, the SPIFFE ID is the one and only URI in the Subject Alternative Name extension. The certificate is usually valid for an hour or less and is rotated automatically.

## How to use the SPIFFE decoder

1. Paste the workload's `-----BEGIN CERTIFICATE-----` block, or open the SVID file.
2. Read the SPIFFE ID, trust domain and whether it's a leaf (workload) or signing certificate.
3. Check the validity window — SVIDs are short-lived and rotate automatically.

You can also read the URI SAN with `openssl`:

```sh Command line
openssl x509 -in svid.pem -noout -ext subjectAltName -dates
# X509v3 Subject Alternative Name:
#     URI:spiffe://prod.example.com/ns/payments/sa/api
```

## X.509-SVID rules

| Rule | Requirement |
|---|---|
| SPIFFE ID location | Exactly one URI SAN |
| Leaf certificate | `CA:FALSE`, with `digitalSignature` key usage |
| Signing certificate | `CA:TRUE`, URI SAN optional |
| Lifetime | Short, typically under 1 hour, rotated automatically |

## FAQ

### What is a trust domain?

The root of trust for a set of identities, usually one per environment or organization. Workloads only trust SVIDs signed by the bundle of their own trust domain or of federated domains.

### Is a SPIFFE ID a secret?

No. It's an identifier, like a username. The private key that goes with the SVID is the secret.

### Can SVIDs be JWTs?

Yes. JWT-SVIDs carry the SPIFFE ID in the `sub` claim and are used where mutual TLS isn't possible. Decode one with the [JWT decoder](/jwt-decoder).