What it does
Paste a PEM certificate, or a whole chain, or drop a .pem, .crt, .cer, .der or .p7b file, and every certificate is decoded into a readable card:
- Subject and issuer, with each attribute (CN, O, OU, C…) shown separately.
- Validity in UTC with an expired, expires soon or valid badge and the number of days remaining.
- Subject Alternative Names: DNS names, IP addresses (IPv4 and IPv6), emails, URIs and Microsoft UPNs.
- Public key algorithm and size or curve (RSA 2048, EC P-256, Ed25519…) and the signature algorithm, including RSASSA-PSS parameters.
- Key usage, extended key usage, basic constraints (is it a CA, path length), subject and authority key IDs, CRL and OCSP URLs, certificate policies (DV / OV / EV) and embedded Certificate Transparency timestamps. Critical extensions are marked.
- SHA-256 and SHA-1 fingerprints, computed with your browser’s WebCrypto.
- Chain check: for each certificate the tool finds its issuer in the list and verifies the signature, so you can see whether a chain is complete, in the right order and really signed by the next certificate.
The decoder is a small ASN.1/DER parser written for this page. No certificate library and no server are involved.
How to use it
Paste the certificate text or drop a file. To check a server, export its chain from the browser’s certificate viewer or run openssl s_client -showcerts -connect host:443 and paste the output. Extra blocks such as private keys are ignored (and flagged).
Privacy
Certificates are public documents, but they are still decoded only in your browser. The pasted text is kept in local storage so a refresh doesn’t lose it; Clear removes it.