PEM Certificate Decoder
Paste any PEM block — a certificate, a certificate signing request, or a key — and read its contents instantly: subject, issuer, serial number, validity dates, signature algorithm, key type, key length and SHA-256 fingerprint.
Privacy note: everything runs locally in your browser. Nothing is uploaded, sent to any server, or stored. Your private keys never leave this device.
Decoded Result
How to use
- Paste a PEM block (including the
-----BEGIN ...-----and-----END ...-----lines) into the input box, or click Load Sample Certificate to try a real one. - Click Decode. The tool detects the PEM type from the header and parses the Base64 body with a built-in ASN.1 reader.
- Read the result table: for certificates you get subject, issuer, serial number, validity period, signature algorithm, key details, SANs and the SHA-256 fingerprint. For keys you get the key type and bit length.
- Use Copy Results to copy the full summary as plain text.
What the fields mean
- Subject CN / Issuer CN: the Common Name of the certificate owner and of the authority that signed it. If they match, the certificate is self-signed.
- Serial number: the unique identifier assigned by the issuer, shown in hexadecimal.
- Valid from / Valid until: the time window in which the certificate is trusted. A certificate outside this window will be rejected by browsers.
- Signature algorithm: the hash + public-key algorithm used to sign the certificate, e.g. sha256WithRSAEncryption.
- SHA-256 fingerprint: a hash of the whole certificate, useful to verify that the certificate you hold is exactly the one a server presents.
Limitations
- Encrypted private keys (ENCRYPTED PRIVATE KEY, password-protected PEM files) are detected but cannot be decoded without the password.
- OpenSSH-format keys (-----BEGIN OPENSSH PRIVATE KEY-----) are detected but their proprietary binary format is not parsed here.
- Only the first PEM block in the input is decoded; certificate chains are out of scope.