> Decode an X.509 certificate in your browser: names, issuer, dates, key, signature, extensions and fingerprints, with plain-language warnings. Source: https://pkizerotohero.com/tools/decoder/ Browser tool # Certificate decoder Paste a certificate and read every field in plain words, next to the name OpenSSL uses for it. Nothing you paste leaves your browser. *Interactive tool: Certificate decoder (runs in the browser at [/tools/](https://pkizerotohero.com/tools/))* ## How to use it 1. Paste a PEM certificate (the block from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----), or drop a .pem, .crt, .cer or .der file on the box. 2. Read the summary first: what kind of certificate it is, whether it is valid today, and what we noticed. 3. Read the field list for the details, or show the OpenSSL-style text to compare it with what openssl x509 -text prints. 4. Pasted several certificates? Open them in the chain checker to see whether they fit together. ## Questions Is it safe to paste a certificate here? Yes. A certificate is public: every server sends it to every visitor. The decoder runs in your browser and sends nothing anywhere. Never paste a private key into any website; this one refuses to read it. Where do I get a server's certificate? From the browser's certificate viewer (export it as PEM), or with openssl s\_client -connect example.com:443 -showcerts, which prints every certificate the server sends. Why are there two fingerprints? They are hashes of the whole certificate, with SHA-256 and with SHA-1. Tools use them to identify a certificate exactly; Windows calls the SHA-1 one the thumbprint. They are not stored in the certificate. Does the decoder check the chain or revocation? No. It reads one certificate at a time; use the chain checker for the chain. Checking revocation needs the CA's servers, and these tools make no network calls. ## Learn what it checks - [Anatomy of an X.509 certificate](https://pkizerotohero.com/handbook/x509-certificates/) - [Names and jobs: SANs, wildcards, key usage and the CA flag](https://pkizerotohero.com/handbook/names-and-key-usage/)