Utility Workspace
SSL/PEM Certificate Decoder
Decode and inspect X.509 certificates
Client-sideX.509 / PEMInstant
Tool Guide
What is a PEM Certificate?
A PEM (Privacy Enhanced Mail) certificate is a Base64-encoded X.509 certificate enclosed between
-----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- headers. It is the most common format for SSL/TLS certificates used to secure websites and services.Practical Flow
How to Use This Tool
- 1Paste Your Certificate: Copy your PEM-encoded certificate and paste it into the input area.
- 2Click Decode: Press the "Decode Certificate" button to parse and inspect the certificate.
- 3View Details: See the subject, issuer, validity dates, serial number, signature algorithm, public key info, and expiry status.
- 4Copy JSON: Click "Copy JSON" to copy all decoded details as a JSON object.
Keep In Mind
Important Note
All parsing is done entirely in your browser. Your certificate data never leaves your device. We use the open-source node-forge library for X.509 parsing.
More Details
What Information is Decoded?
- Subject: The entity the certificate is issued to.
- Issuer: The Certificate Authority that signed the certificate.
- Validity: The date range during which the certificate is valid.
- Serial Number: A unique identifier assigned by the CA.
- Signature Algorithm: The algorithm used to sign the certificate (e.g., SHA-256 with RSA).
- Public Key: The type and size of the public key (e.g., RSA 2048-bit).
- SANs: Subject Alternative Names — additional domains covered by the certificate.
FAQ
Frequently Asked Questions
- What is a PEM certificate?
- A PEM (Privacy Enhanced Mail) certificate is a Base64-encoded X.509 certificate enclosed between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- headers. It is the most common format for SSL/TLS certificates.
- Is the certificate data sent to a server?
- No. All parsing is done entirely in your browser using the node-forge library. Your certificate data never leaves your device.
- What information does the decoder show?
- Subject, issuer, validity period (valid from / valid to), serial number, signature algorithm, public key type and size, and whether the certificate is currently valid or expired.
Explore More
JWT DecodeInspect and verify JSON Web Token payloads and headers.
UUID GeneratorGenerate UUID/GUID v1, v4, and v5 identifiers instantly.
Hash GeneratorGenerate MD5, SHA-1, SHA-256, SHA-512 hashes from any text.
SAML DecoderDecode Base64-encoded SAML responses and inspect XML.
Base64 EncodeConvert plain text or binary data into Base64 format instantly.
Base64 DecodeDecode Base64 strings back to readable text or binary data.
URL Encode/DecodeEncode or decode URLs, query strings and special characters.
Base64 ImageConvert images to Base64 strings and decode Base64 back to images.