Inspectors

Certificate Decoder (X.509)

Paste a PEM-encoded X.509 certificate and get a human-readable breakdown of its contents. The tool shows the subject (who the certificate is for), issuer (who signed it), validity period, subject alternative names (SANs), public key info, signature algorithm, and fingerprints (SHA-256, SHA-1). It also flags common issues like expired certificates.

Certificate Decoder (X.509) — Decode a PEM certificate — subject, issuer, validity, SANs, fingerprints

What it does

  • ▸Decodes PEM-encoded X.509 certificates
  • ▸Shows subject, issuer, and certificate chain information
  • ▸Displays validity period (not before, not after) with expiration warnings
  • ▸Lists Subject Alternative Names (SANs) — domains and IPs covered
  • ▸Shows public key algorithm, key size, and key usage extensions
  • ▸Computes SHA-256 and SHA-1 fingerprints

Use cases

  • ▸Inspecting a TLS certificate to verify its subject and SANs
  • ▸Checking if a certificate is expired or about to expire
  • ▸Verifying the key size and algorithm of a certificate
  • ▸Debugging certificate chain issues in HTTPS connections

How it works

1

Paste your PEM certificate (-----BEGIN CERTIFICATE-----) into the input

2

The tool parses the ASN.1 DER structure and extracts all fields

3

The decoded information is displayed in structured output fields

4

Review the subject, issuer, validity, SANs, and key information

Frequently asked questions

1What format does the certificate need to be in?

PEM format — a base64-encoded block wrapped in -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers. This is the standard format used by Apache, nginx, and most TLS tools. DER (binary) format is not supported — convert it to PEM first.

2Can it decode certificate chains?

Yes. If you paste multiple PEM certificates (the server certificate followed by intermediate certificates), the tool decodes each one and shows the chain relationship.

3Does it check if the certificate is valid?

The tool shows the validity period (not before / not after) and flags if the current date is outside that range. It doesn't verify the signature against a CA — for that, use openssl verify or a TLS client.

Related tools

Certificate Generator — Generate self-signed X.509 certificates with RSA, ECDSA, or Ed25519 keys

Certificate Generator

Generate self-signed X.509 certificates with RSA, ECDSA, or Ed25519 keys

JWT Debugger — Decode JWT tokens, inspect claims, verify signatures, and sign new tokens

JWT Debugger

Decode JWT tokens, inspect claims, verify signatures, and sign new tokens

JWT Key Generator — Generate cryptographically secure keys for every JWT algorithm — HMAC, RSA, ECDSA, EdDSA

JWT Key Generator

Generate cryptographically secure keys for every JWT algorithm — HMAC, RSA, ECDSA, EdDSA

HTTP Header Analyzer — Parse HTTP headers, explain their purpose, and flag missing security headers

HTTP Header Analyzer

Parse HTTP headers, explain their purpose, and flag missing security headers

Use Certificate Decoder (X.509) offline in Devinity

All 95 tools run locally on your Mac. No internet required, no data sent to servers.

Download Devinity →