x509 decoder

About this tool

This tool parses X.509 certificates in PEM, DER, CRT, CER, and PKCS#7 formats, and reports the subject, issuer, validity period, serial number, signature and public-key algorithms, extension values (KeyUsage, ExtendedKeyUsage, SAN, AIA, CRL, SKI, AKI, and more), and the SHA-256 fingerprint. It also infers the certificate profile (server, client, code signing, intermediate CA, root CA, etc.) and suggests a chain based on certificates bundled in the same file. All processing takes place entirely in your browser; no data is transmitted.

Drag and drop files here or use “Choose files”. Analysis runs as soon as files are added.
Supported formats: PEM (-----BEGIN CERTIFICATE-----), DER/CRT/CER, PKCS#7 (.p7b, .p7c, .spc)

Summary

# File name CN (Subject) CN (Issuer) Serial Not Before Not After Profile Verification

Details

How to use

  1. Choose certificate files via “Choose files” or drag and drop them into the panel.
  2. Analysis runs automatically when files are added, populating the summary and details. Export JSON or CSV as needed.
  3. Toggling “Simple signature verification” or “Show ASN.1/DER hex” re-runs analysis with the new settings.

Notes and cautions

  • No online checks against external root stores or OCSP/CRL are performed. Verification is limited to signatures within the bundled chain; revocation, key strength, or policy compliance are not guaranteed.
  • PKCS#7 (P7B) bundles are expanded and listed. An error is shown if the archive contains no certificates.
  • Dates are normalized to ISO 8601 (Z=UTC). The summary table shows dates (YYYY-MM-DD) for readability.
  • Large files or many certificates may consume browser memory/CPU. Use the clear button to reset the state.
  • The tool infers certificate profiles from extensions as a heuristic and does not guarantee alignment with each CA’s policies.
  • If DER/PEM detection is difficult (mixed PEM blocks in text), create a file containing only the certificate block and retry.

All processing takes place entirely in your browser, and no certificate contents leave the device.