X.509 / SSL Certificate Decoder & Parser
Decode a PEM certificate into readable fields.
Free · no sign-up · runs locally·
About this tool
An SSL/TLS certificate is an X.509 structure serialized as ASN.1 DER and wrapped in PEM armor. This parser walks the raw bytes and renders the full tag tree — subject and issuer names, validity period, public-key algorithm, signature algorithm, and extensions like Subject Alternative Names — with common OIDs translated to human-readable names.
It's the fastest way to see exactly what a certificate contains without shipping it to an online decoder's server. Parsing happens entirely in your browser.
Like everything on encrypt.tools, this runs entirely in your browser — nothing you enter is transmitted or stored.
Do the same in a terminal
Reproduce or cross-check this tool with standard command-line utilities. For deterministic operations like hashing and encoding, the output matches exactly.
openssl x509 -in cert.pem -noout -text
# Inspect a live server's certificate:
openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -textFrequently asked questions about X.509 Certificate Parser
Is it safe to decode a certificate here?+
Yes — certificates are public by design (they're sent to every visitor of an HTTPS site), and this tool parses them entirely in your browser without uploading anything. It's safe to paste any certificate.
What can I learn from a decoded certificate?+
The subject (who it's for), issuer (which CA signed it), validity dates, the public key and its algorithm, the signature algorithm, and extensions such as Subject Alternative Names (the domains it covers) and key usage constraints.
Can I decode the private key too?+
Use the ASN.1 parser or PEM/DER tools for keys. This tool focuses on certificates. Never paste a private key into any online tool you don't fully control — though this one does run locally.