Does this verify that my certificate is trusted?

No. Decoding reads fields, and the date status uses your device clock. The tool does not verify signatures, hostname matches, trust chains, or revocation.

Does my certificate leave the browser?

The decoder processes input locally, does not upload or save it, and does not connect to the certificate's domains. Private keys and CSRs are not accepted.

Can I paste a full certificate chain?

You can paste up to 20 complete CERTIFICATE PEM blocks within the 1,000,000-character input limit. Each is decoded separately in input order. Chain relationships and trust are not checked.

Which extensions does it decode?

It decodes DNS, IP, email, and URI entries in Subject Alternative Name. Other SAN types are marked as not decoded; other extensions are listed by OID and critical flag only. RSA-PSS parameters are not decoded, and unknown algorithms retain their OID.

TLS Certificate Decoder

Runs locally in your browser. Certificate input is not uploaded or saved. Paste certificates only—never private keys.

X.509 certificate or PEM bundle

Paste a certificate to inspect its fields.

Up to 20 PEM certificates, maximum 1,000,000 input characters. Dates are shown in UTC and checked against your device clock. This does not check signatures, hostname matches, trust chains, or revocation, and does not contact a server. A bundle is decoded in input order, not verified as a chain.

Certificate details

Decoded report

The report can include internal domain names, email addresses, and IP addresses. Review it before sharing. Extensions other than SAN are listed by OID but not decoded.

Learn

TLS Certificate Decoder Guide

About this tool

Decode the fields inside an X.509 PEM certificate, including its subject, issuer, subject alternative names, validity dates, public key algorithm, serial number, and SHA-256 fingerprint. Bundles are decoded in input order, not validated as a chain.

Questions

Does this verify that my certificate is trusted?: No. Decoding reads fields, and the date status uses your device clock. The tool does not verify signatures, hostname matches, trust chains, or revocation.
Does my certificate leave the browser?: The decoder processes input locally, does not upload or save it, and does not connect to the certificate’s domains. Private keys and CSRs are not accepted.
Can I paste a full certificate chain?: You can paste up to 20 complete CERTIFICATE PEM blocks within the 1,000,000-character input limit. Each is decoded separately in input order. Chain relationships and trust are not checked.
Which extensions does it decode?: It decodes DNS, IP, email, and URI entries in Subject Alternative Name. Other SAN types are marked as not decoded; other extensions are listed by OID and critical flag only. RSA-PSS parameters are not decoded, and unknown algorithms retain their OID.