CSR (Certificate Signing Request) Decoder
Inspect the subject and key inside a PKCS#10 CSR.
Free · no sign-up · runs locally·
About this tool
Before you send a Certificate Signing Request to a certificate authority, it's worth confirming it contains exactly what you intend — the right common name, organization, and any Subject Alternative Names. This tool decodes a PKCS#10 CSR from PEM into its ASN.1 structure, surfacing the subject fields, public-key algorithm, and requested attributes.
Catching a typo in the CN or a missing SAN here saves a wasted issuance cycle. Everything is parsed in your browser.
Like everything on encrypt.tools, this runs entirely in your browser — nothing you enter is transmitted or stored.
Do the same in a terminal
Reproduce or cross-check this tool with standard command-line utilities. For deterministic operations like hashing and encoding, the output matches exactly.
openssl req -in request.csr -noout -text -verifyFrequently asked questions about CSR Decoder
What should I check in a CSR before submitting it?+
Confirm the Common Name (CN) matches your domain exactly, the organization details are correct, any Subject Alternative Names include every hostname you need, and the public-key algorithm and size meet the CA's requirements.
Does a CSR contain my private key?+
No — a CSR contains only your public key and identifying details, signed by your private key to prove you hold it. The private key stays on your server. That's why it's safe to decode a CSR.
Can I generate a CSR here?+
This tool decodes existing CSRs. Generate CSRs with OpenSSL or your server software; CSR generation is on the roadmap.