# TLS Certificate Decoder

Decode X.509 PEM certificates to inspect subject, issuer, SANs, validity dates, public key details, and SHA-256 fingerprints locally.

## URL

https://ilham.dev/tools/tls-certificate-decoder/

## What It Does

Decode the fields inside an X.509 PEM certificate, including its subject, issuer, subject alternative names, validity dates, public key algorithm, serial number, and SHA-256 fingerprint. Bundles are decoded in input order, not validated as a chain.

## Features

- Decode core X.509 certificate fields and SANs
- Inspect UTC validity dates against the device clock
- Compute a SHA-256 certificate fingerprint
- Decode up to 20 PEM certificates in input order

## Input

X.509 CERTIFICATE PEM blocks text input.

## Output

Decoded certificate report text output.

## Privacy

Processing happens locally in the browser.

No input data is uploaded to ilham.dev.

- Requires login: false
- Requires API key: false
- Stores user data: false


## Examples

- Does this verify that my certificate is trusted?
- Does my certificate leave the browser?
- Can I paste a full certificate chain?
- Which extensions does it decode?


## Limitations

- No signature, trust chain, hostname, or revocation verification
- No remote server connection
- Only SAN extensions are decoded; others are listed by OID
- RSA-PSS parameters and uncommon name string types are not decoded
- PEM only, with a 1,000,000-character input limit


## Related Tools

- https://ilham.dev/tools/nginx-reverse-proxy-wizard/
- https://ilham.dev/tools/file-hash-checker/


## Questions

### Does this verify that my certificate is trusted?

No. Decoding reads fields, and the date status uses your device clock. The tool does not verify signatures, hostname matches, trust chains, or revocation.

### Does my certificate leave the browser?

The decoder processes input locally, does not upload or save it, and does not connect to the certificate's domains. Private keys and CSRs are not accepted.

### Can I paste a full certificate chain?

You can paste up to 20 complete CERTIFICATE PEM blocks within the 1,000,000-character input limit. Each is decoded separately in input order. Chain relationships and trust are not checked.

### Which extensions does it decode?

It decodes DNS, IP, email, and URI entries in Subject Alternative Name. Other SAN types are marked as not decoded; other extensions are listed by OID and critical flag only. RSA-PSS parameters are not decoded, and unknown algorithms retain their OID.