Certificate Decoder: Free Online PEM Reader

A certificate decoder turns the block of encoded text in a PEM file into readable fields. Paste your SSL/TLS certificate into this free tool and you see the subject, issuer, validity dates, days remaining, key type and size, signature algorithm, alternative names, extensions and fingerprints in one clear view.

What Is a Certificate Decoder?

A certificate decoder reads an X.509 certificate and shows the data packed inside it. X.509 is the standard format behind HTTPS, and a certificate is a signed statement that links a public key to a domain name or organization.

Most certificates travel as PEM text. That is a Base64 version of the binary certificate wrapped between a -----BEGIN CERTIFICATE----- line and an -----END CERTIFICATE----- line. The Base64 looks like random characters, but it holds structured fields. Decoding it reveals who the certificate was issued to, who issued it, when it is valid and what it may be used for.

What the decoder shows

• Common name and organization: the main name the certificate was issued to, plus the company name when one is included.
• Issuer: the certificate authority (CA) that signed it, with its organization name.
• Location: city, state and country from the subject, when present.
• Valid From and Valid To: the dates the certificate is usable, with a status badge and a days-remaining count.
• Key type and key size: for example RSA at 2048 bits.
• Signature, version and serial number: technical identifiers you often need for tickets or audits.
• Subject Alternative Names: every hostname the certificate covers, with a count.
• Extensions: Key Usage, Extended Key Usage and Basic Constraints.
• Fingerprints: SHA-256 and SHA-1 values that identify the exact certificate.

How to Use the Certificate Decoder

You decode a certificate by pasting its PEM text into the form and submitting it. The whole process takes a few seconds.

1. Get your certificate as PEM text. It is usually a file ending in .pem, .crt or .cer that you can open in any text editor.
2. Copy everything from the BEGIN CERTIFICATE line to the END CERTIFICATE line, including both lines.
3. Paste it into the box labeled Certificate (PEM).
4. Click Decode Certificate.
5. Read the results: the status badge first, then the dates, issuer, names and key details.
6. Use the link at the bottom of the results to go back and decode another certificate.

If you leave the box empty, the tool asks you to provide the certificate data. If the text cannot be read as a certificate, you see a message to check the format.

Worked Example: Reading a Real-World Result

Say you paste a certificate for www.example.com and the page returns the values below. This is a sample for illustration.

The badge reads Expiring Soon because 24 days is inside the 30-day window. The key size is fine, so the only action is renewal. The Subject Alternative Names list shows three entries: example.com, www.example.com and shop.example.com. That tells you the certificate also covers the bare domain and the shop subdomain, so you do not need a separate one for them.

Now imagine the same certificate listed only www.example.com in its names. Visitors who open the bare domain would see a name mismatch warning. Decoding catches that before users do.

How Do You Read and Act on the Results?

Start with the status badge and the days-remaining line, then check names, key strength and usage. Each section tells you something different.

Expiry status

The badge shows Valid when more than 90 days remain, Expiring when 90 days or fewer remain, Expiring Soon at 30 days or fewer, and Expired once the end date has passed. For an expired certificate the tool tells you how many days ago it expired. Renew in the Expiring stage, not the last week. Publicly trusted certificates have been limited to a maximum of 398 days since 2020, and the industry is moving toward shorter lifetimes, so renewal should be routine or automated.

Common name and Subject Alternative Names

Browsers match the hostname you visit against the Subject Alternative Names list. The common name alone is not enough for modern browsers. If the hostname you serve is missing from the list, reissue the certificate with the right names. A wildcard entry such as *.example.com covers one subdomain level only, so it does not cover a.b.example.com.

Key type and size

RSA keys of 2048 bits are a widely used minimum, and 3072 or 4096 bits are common for longer-lived keys. EC keys (such as 256-bit) give comparable security with smaller values. A 1024-bit RSA key is considered weak and should be replaced.

Signature algorithm

Look for SHA-256 or stronger, such as sha256WithRSAEncryption. A SHA-1 signature is deprecated, and browsers reject it for public websites. If you see one, ask your CA to reissue the certificate.

Extensions

• Key Usage: what the key may do, such as Digital Signature or Key Encipherment.
• Extended Key Usage: the purpose, such as TLS Web Server Authentication or Client Authentication. A web server certificate needs the server purpose.
• Basic Constraints: shows whether the certificate is a CA. A normal website certificate should say CA:FALSE. An intermediate or root shows CA:TRUE.

Fingerprints and serial number

The SHA-256 fingerprint is a hash of the whole certificate. Compare it with the value shown in a browser or your CA dashboard to confirm you are looking at the exact same certificate. The serial number is unique per CA, and support teams often ask for it.

When Should You Use a Certificate Decoder?

Use it any time you have certificate text and need to know what is inside before you install, renew or trust it.

• Before installing: confirm the names, issuer and dates match what you ordered from the CA.
• Renewal planning: check days remaining for certificates you manage by hand.
• Troubleshooting browser warnings: find a missing hostname, an expired date or the wrong certificate on a server.
• Audits: record key size, signature algorithm and fingerprints for compliance notes.
• Learning: see what each X.509 field looks like on a real certificate.

If you have a certificate request instead of an issued certificate, use the CSR Decoder. If you need to confirm a certificate pairs with a private key, the Certificate Key Matcher does that comparison. To validate a request file, try Check CSR.

Best Practices and Troubleshooting

Most failed decodes come from a copy and paste problem, not a bad certificate. These are the fixes that solve the majority of cases.

• Include the BEGIN and END lines. Pasting only the Base64 body without the header and footer lines will usually fail.
• Paste one certificate at a time. A chain file contains the server certificate plus intermediates. Split it and decode each block separately so you know which one you are reading.
• Do not paste a private key or a request. A key block begins with a PRIVATE KEY line, and a request begins with CERTIFICATE REQUEST. This tool expects a certificate. Decode requests with the CSR Decoder, and never share a private key with any website.
• Watch for stripped line breaks. Email clients and chat apps can wrap or merge lines. Copy straight from the file.
• Convert other formats first. Binary DER files and PKCS#12 bundles are not PEM text. Convert them to PEM before pasting.
• Check the right certificate. A server often sends a chain, and the first certificate is normally the one for your domain. The intermediates show Basic Constraints of CA:TRUE.

If you prefer the command line, you can get similar details from a local openssl x509 -text -noout command run against the file. The decoder gives you the same kind of information in a cleaner layout, without installing anything.

What Are the Limits of a Certificate Decoder?

A decoder reads the certificate you paste. It does not test the live site that uses it.

• A Valid badge means the dates have not passed. It does not prove the certificate is trusted, that its chain is complete or that it has not been revoked.
• It does not check whether the certificate is installed on your server, or which certificate your server is actually serving.
• It cannot decrypt a private key, and a certificate does not contain one. Questions like how to decrypt a certificate private key are a different task, and a certificate never holds that secret.
• The days-remaining figure is based on the current date at the moment you decode.

For the full picture, decode the certificate here, then confirm the installed version and chain on the live server.

Decode Your Certificate Now

Paste your PEM text into the box above and click Decode Certificate to see the issuer, names, expiry date and key strength in seconds. If you do not have a request or certificate yet, the CSR Generator is the place to start. You can find more related utilities in the Security & Encryption Tools category.