# X.509 certificate decoder — subject, SANs & expiry, no upload

> Free X.509 certificate decoder: paste a PEM certificate to read its subject, issuer, SANs, validity dates, and thumbprint. Parsed in your browser, nothing uploaded.

Paste a PEM certificate to read its subject and issuer, the Subject Alternative Names it covers, its validity window, and its fingerprint. The certificate is parsed in your browser, so nothing is sent to a server.

Certificates fail in boring, high-stakes ways: an expired leaf, a missing SAN, the wrong issuer chain. Decoding the PEM makes those visible immediately — you see exactly which names it covers, who signed it, and the window it's valid for.

The fingerprint is useful for certificate pinning and for confirming two systems are talking about the same certificate. Pasting rather than uploading matters here because internal PKI certificates often reveal private hostnames and topology.

To inspect a token signed under the same PKI use the JWT decoder, convert the embedded public key with the Key converter, or mint test keys with the Key pair generator.

## How to

1. **Paste the PEM.** Drop the -----BEGIN CERTIFICATE----- block into the tool.
2. **Read the identity.** See the subject, issuer, and every Subject Alternative Name.
3. **Check validity.** View the not-before / not-after dates and whether it's currently valid.
4. **Grab the fingerprint.** Copy the thumbprint for pinning or comparison.

## FAQ

### How do I decode an SSL/TLS certificate?

Paste the PEM text and the tool parses the X.509 structure, listing the subject, issuer, SANs, key details, validity dates, and thumbprint in readable form.

### How do I check which domains a certificate covers?

Look at the Subject Alternative Names (SANs) — that list, not the common name, is what browsers use to decide whether a certificate matches a hostname.

### Can it tell me when a certificate expires?

Yes. The not-after date is shown along with a clear valid / expired indicator so you can catch certificates that are past due or about to lapse.

### Is the certificate uploaded to decode it?

No. Parsing happens locally in your browser, so even an internal certificate with private hostnames stays on your machine.


## Related tools

- [Key format convert](https://www.safepaper.app/security/key-convert)
- [Key pair generator](https://www.safepaper.app/security/key-pair)
- [JWT decoder](https://www.safepaper.app/security/jwt-decoder)
- [Hash & checksum](https://www.safepaper.app/security/hash-verify)

---

Canonical HTML: https://www.safepaper.app/security/x509-decoder
Markdown: https://www.safepaper.app/security/x509-decoder.md

There is no upload endpoint — your files are processed in this browser tab. Open your network tab and check.