Josh Liljenquist

Private, browser-local utility

X.509 Certificate Decoder

Decode metadata from one public PEM certificate locally without trust or revocation checks.

Your input and result stay in this browser tab. Nothing is uploaded, fetched, executed, logged, or stored.

Paste public certificates only. Private keys and certificate signing requests are explicitly refused.

Loading local tool…

Decoded fields and trust boundary

The bounded DER/ASN.1 parser shows version, serial, subject, issuer, UTC validity, signature and public-key algorithms, key size where available, SHA-256 fingerprint, SAN, key usage, extended key usage, basic constraints, SKI, and AKI. Input is limited to one PEM certificate, 1 MB of text, 750 KB decoded DER, and 40 nesting levels.

Parsing is not certificate verification. This tool does not validate a chain, hostname, trust store, revocation, transparency log, or current security. It performs no lookup or network request.