What is the difference between PEM and DER?

DER is the raw binary ASN.1 encoding. PEM is that same DER, Base64-encoded and wrapped in BEGIN/END header lines so it can be pasted into a text file. They carry identical information.

Why does my browser still warn when the Common Name matches?

Because browsers stopped honouring Common Name for hostname verification. The name must appear in the Subject Alternative Name extension — a certificate with only a CN is treated as having no valid hostname.

Is it safe to paste a certificate here?

Yes, twice over: certificates are public information, and this decoder runs entirely in your browser. Never paste a private key — into this or any online tool.

How do I read the certificate chain?

Decode each certificate in turn. The subject of each should match the issuer of the one before it, ending at a self-signed root where subject and issuer are identical.

X.509 Certificate Decoder

Parse a PEM or DER certificate and read its subject, issuer, SANs and validity.

on the roadmapSecurity, PKI & Cryptofree · no sign-up

This bench is being wired up

The x509-certificate-decoder decoder is on the roadmap. The heavier binary and cryptographic parsers ship after the core text and token decoders — all of which are already live and working.

Browse the live decoders

Input is processed on your device. Nothing you paste is sent anywhere.

What is the X.509 Certificate Decoder?

An X.509 certificate decoder parses the ASN.1 structure of a TLS/SSL certificate and presents its fields — subject, issuer, validity window, public key, extensions and fingerprints — in readable form, doing in the browser what openssl x509 -text does on the command line.

An X.509 certificate binds a public key to an identity, signed by a certificate authority. The container is DER-encoded ASN.1, usually wrapped in Base64 between -----BEGIN CERTIFICATE----- lines (that wrapper is PEM). Nothing in it is secret — a certificate is public by design — which is why decoding one locally is entirely safe.

The fields that resolve real problems are few. Subject Alternative Name is what browsers actually match the hostname against; Common Name has been ignored for that purpose for years. Not Before / Not After define the validity window, and 'expired certificate' remains one of the most common production outages. Basic Constraints says whether the certificate may sign others, Key Usage and Extended Key Usage say what it is allowed to do, and the Authority/Subject Key Identifiers are how you assemble a chain in the right order.

The SHA-256 fingerprint gives you a stable identity for the certificate itself — the value to compare when pinning, when verifying that a deployed certificate matches the one you issued, or when checking against a CT log entry.

X.509 Certificate Decoder at a glance

Standard: X.509 v3 · RFC 5280
Encoding: DER (binary ASN.1), often PEM-wrapped Base64
Hostname match: Subject Alternative Name — not Common Name
Sensitive?: No — certificates are public; private keys are not

How to use the X.509 Certificate Decoder

1Paste the certificate, including the BEGIN and END CERTIFICATE lines.
2Read the subject, issuer, validity window and SAN list in the decoded output.
3Compare the SHA-256 fingerprint against the certificate you expect to be deployed.

When you would reach for it

Confirming which hostnames a deployed certificate actually covers.
Checking expiry dates before a renewal window closes.
Untangling a chain order or intermediate mismatch during a TLS handshake failure.

X.509 Certificate Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools