Toolbox101 All tools

Dev Utilities

Decode X.509 certificates from PEM

X.509 Cert Decoder reads a certificate's DER structure and prints the fields you need when debugging TLS handshakes or checking a peer's identity: subject and issuer, serial number, validity window, public-key algorithm, SANs, key usage, CA flag, plus SHA-1 and SHA-256 fingerprints over the full DER bytes. Paste a full PEM block, bare DER hex starting with the 30 SEQUENCE byte, or base64 without the armor lines.

Open X.509 Cert Decoder in the app Browse all tools

How to use X.509 Cert Decoder

  1. Open X.509 Cert Decoder in the Toolbox101 app.
  2. Paste the full certificate into the Input box: a PEM block with BEGIN and END CERTIFICATE lines, bare DER hex that starts with 30, or base64 without the armor.
  3. Read the parsed fields in the Output box: Subject, Issuer, Serial, Not Before, Not After, the public-key algorithm, SANs, key usage, the CA flag, and the SHA-1 and SHA-256 fingerprints.
  4. Paste a second certificate and compare: identical fingerprints mean the two inputs hold the same DER bytes.
  5. Click Copy to paste the summary into a ticket.

Worked example

X.509 Cert Decoder returns the output below for this input.

Input

-----BEGIN CERTIFICATE-----
MIIB3TCCAYOgAwIBAgIBATAKBggqhkjOPQQDAjA5MQswCQYDVQQGEwJVUzEUMBIG
A1UECgwLRXhhbXBsZSBJbmMxFDASBgNVBAMMC2V4YW1wbGUuY29tMB4XDTI2MDkw
NzE5MjIzNloXDTI2MTAwNzE5MjIzNlowOTELMAkGA1UEBhMCVVMxFDASBgNVBAoM
C0V4YW1wbGUgSW5jMRQwEgYDVQQDDAtleGFtcGxlLmNvbTBZMBMGByqGSM49AgEG
CCqGSM49AwEHA0IABAwaf6woRL35fef4oSjqKn87DjyMSfIz8e4Oz4IkYQ7Fsof9
Ch0Y41mbJUzlGAjJFOGHnxy3pMEbBisg/MzfuJijfDB6MB0GA1UdDgQWBBQzVeLt
KFiBDS1LvB8pg5QdkfRmcTAfBgNVHSMEGDAWgBQzVeLtKFiBDS1LvB8pg5QdkfRm
cTAnBgNVHREEIDAeggtleGFtcGxlLmNvbYIPd3d3LmV4YW1wbGUuY29tMA8GA1Ud
EwEB/wQFMAMBAf8wCgYIKoZIzj0EAwIDSAAwRQIgHKHl32N7TYlUpNfeueJD1UvE
XWFGv7kxSy57oW8NUYUCIQD9Mf5Otl0HsUSEI6UhptffgoWp4TckiKr7aBQtwvc7
mg==
-----END CERTIFICATE-----

Output

Subject: CN=example.com, O=Example Inc, C=US
Issuer: CN=example.com, O=Example Inc, C=US
Serial: 01
Not Before: 2026-09-07T19:22:36Z
Not After: 2026-10-07T19:22:36Z
Algorithm: ecPublicKey (ECDSA)
SAN: example.com, www.example.com
CA: true
SHA-1: 51:16:63:a0:fd:fc:b3:3a:5f:9a:06:d4:1f:03:1f:c0:43:03:e7:33
SHA-256: 58:de:af:ba:de:dd:3b:19:4d:31:6a:36:80:95:56:ae:06:9d:bd:83:b3:96:1a:29:a3:77:ac:c1:85:0c:e7:08

Check it yourself: open X.509 Cert Decoder and enter the same input.

Frequently asked questions

Which certificate formats can I paste?

Three forms are accepted: a PEM block between BEGIN and END CERTIFICATE markers, bare DER encoded as hex when it starts with the 30 SEQUENCE byte, and base64 without the armor lines. Whitespace between lines is ignored. One certificate per paste; a bundle or chain is rejected rather than partially decoded.

What does the decoder show for a certificate?

The Output lists Subject and Issuer names, most specific first (CN, then O, then C), the Serial as colon-separated lowercase hex, Not Before and Not After timestamps, the public-key algorithm with its key size, SAN hostnames, key usage flags, the CA flag, and SHA-1 plus SHA-256 fingerprints of the whole certificate.

How do I check a fingerprint with OpenSSL?

Compare the SHA-256 line here with the output of openssl x509 -in cert.pem -noout -fingerprint -sha256 run on the same file. Both sides hash the exact DER bytes, so any difference between two copies of a certificate changes the colon-separated fingerprint completely, which is what you want when verifying a download or a server certificate.

What happens if I paste a private key?

A private key is not a certificate, so it is rejected: PEM input without a CERTIFICATE marker fails with not a certificate PEM, and the DER inside a key file does not parse as a certificate. Either way, a private key belongs in a password manager or key store, not in a decoder box.

Use X.509 Cert Decoder now

Open X.509 Cert Decoder in the app

Runs in your browser. Nothing you type is uploaded.