There is no upload endpoint — your files are processed in this browser tab. Open your network tab and check. See how it stays private.
How to decode an X.509 certificate
- Paste the PEM. Drop the -----BEGIN CERTIFICATE----- block into the tool.
- Read the identity. See the subject, issuer, and every Subject Alternative Name.
- Check validity. View the not-before / not-after dates and whether it's currently valid.
- Grab the fingerprint. Copy the thumbprint for pinning or comparison.
Certificates fail in boring, high-stakes ways: an expired leaf, a missing SAN, the wrong issuer chain. Decoding the PEM makes those visible immediately — you see exactly which names it covers, who signed it, and the window it's valid for.
The fingerprint is useful for certificate pinning and for confirming two systems are talking about the same certificate. Pasting rather than uploading matters here because internal PKI certificates often reveal private hostnames and topology.
To inspect a token signed under the same PKI use the JWT decoder, convert the embedded public key with the Key converter, or mint test keys with the Key pair generator.
Frequently asked questions
How do I decode an SSL/TLS certificate?
Paste the PEM text and the tool parses the X.509 structure, listing the subject, issuer, SANs, key details, validity dates, and thumbprint in readable form.
How do I check which domains a certificate covers?
Look at the Subject Alternative Names (SANs) — that list, not the common name, is what browsers use to decide whether a certificate matches a hostname.
Can it tell me when a certificate expires?
Yes. The not-after date is shown along with a clear valid / expired indicator so you can catch certificates that are past due or about to lapse.
Is the certificate uploaded to decode it?
No. Parsing happens locally in your browser, so even an internal certificate with private hostnames stays on your machine.