X.509 Certificate Decoder & Inspector
Inspect PEM certificates and local DER files, certificate dates, extensions and SHA-256 fingerprints.
Certificates and keys stay local. Inspection does not verify a trust chain, hostname, revocation or TLS endpoint. No certificate URL, OCSP, CRL or AIA destination is contacted.
Certificate
Inspection report
Ready.
Inspect certificates without contacting a server.
Paste one to four PEM CERTIFICATE blocks or select a local DER certificate file. A mature ASN.1/X.509 parser runs in an on-demand worker. Subject, issuer, serial, version, signature/public-key algorithms, key size or curve, validity, SAN and extensions are displayed as inert text. Certificate URLs are never followed. PEM private-key input is rejected; verification never requires a private key.
Read certificate information in context.
Basic Constraints distinguishes CA and end-entity certificates without implying trust. SAN can include DNS, IP, URI and email values; wildcard names receive an informational finding. Key Usage, Extended Key Usage, Subject/Authority Key Identifiers, Certificate Policies, CRL Distribution Points and Authority Information Access are exposed when present. Unknown extensions remain visible by OID and encoded value. Unsupported structures may produce a safe parse error.
Dates and fingerprints do not establish trust.
Validity uses your browser clock at inspection and reports Not yet valid, Currently within validity period or Expired. This is only a time check. SHA-256 fingerprints hash the complete certificate DER bytes locally using Web Crypto, shown as colon-separated uppercase hexadecimal. Changing PEM line wrapping does not change DER identity. No certificate signature, PKIX chain, hostname, revocation, OCSP, CRL or TLS endpoint validation is performed.
Bounded local processing.
PEM is limited to 128 KiB, each certificate or DER file to 16 KiB, bundles to four certificates, extensions to 64 and SAN entries to 128. ASN.1 parsing limits depth to 32 and nodes to 4,096. Display fields are bounded and truncation is labeled; total report output is limited to 192 KiB. Workers stop after a two-second processing deadline and can be cancelled. Reset and page exit terminate processing and clear local input. No certificates or keys are uploaded or stored. Samples are synthetic and are not trusted credentials.