X.509 Decoder

Parse PEM/DER certificates and inspect subject, SAN, and validity locally.

Privacy: 100% Client-Side. Your data never leaves this browser tab. Processing uses Web APIs and client-side libraries only.

Paste a single cert, a full chain (leaf first, then intermediates / root), or a CSR. Chain PEMs from the cert generator work as-is.

What does the X.509 decoder show?

Certificates carry identity and trust metadata used by TLS, SAML, and mTLS. Reading Subject, Issuer, SANs, and expiry quickly helps debug handshake and SSO failures.

This decoder parses PEM/DER locally so certificate contents are not uploaded for inspection.

How to use this tool

  1. Paste a PEM certificate or provide DER/Base64 input.
  2. Review subject, issuer, SANs, key usage, and validity.
  3. Compare the decoded fields with what your SP, IdP, or TLS client expects.

Frequently asked questions

Is the certificate uploaded?

No. Decoding runs in your browser. Prefer not pasting production private keys into any web tool.