X.509 / PEM Certificate Decoder
Paste a PEM certificate or full chain to see subject, issuer, expiry, SANs, key details, and fingerprints
Grab a site's chain with openssl s_client -connect example.com:443 -showcerts </dev/null and paste the output — everything outside the BEGIN/END blocks is ignored.
About this tool
The ToolNinja Certificate Decoder reads PEM-encoded X.509 certificates, the format behind every HTTPS site, and shows what's inside: subject and issuer, validity dates with an expiry countdown, Subject Alternative Names, key type and size, signature algorithm, extensions, and SHA-256 and SHA-1 fingerprints. Paste a whole chain and each certificate is decoded separately and labelled as leaf, intermediate, or root, which makes it easy to spot a missing intermediate or a chain in the wrong order. The decoder parses the ASN.1/DER structure directly in your browser, so certificates and the internal hostnames they often list never leave your machine. It has been checked field by field against OpenSSL's own output for both RSA and elliptic-curve certificates.
When to use it
- →Checking when a TLS certificate expires before it causes an outage
- →Confirming which hostnames a certificate covers (its SANs)
- →Inspecting a certificate chain for a missing or wrong intermediate
- →Getting a certificate's SHA-256 fingerprint for pinning or comparison
Tips
- ◆Run openssl s_client -connect example.com:443 -showcerts </dev/null and paste the whole output; anything outside the BEGIN/END blocks is ignored.
- ◆Modern browsers ignore the Common Name for hostname matching and only check SANs. If a hostname isn't in the SAN list, the certificate won't be trusted for it.
- ◆A certificate whose subject and issuer are identical is self-signed. That's normal for a root CA and a red flag for a leaf certificate.
Frequently asked questions
Is it safe to paste a certificate here?
Yes. A certificate is public information that a server hands to anyone who connects. It contains only the public key, never the private key. Parsing still happens entirely in your browser regardless.
Can it decode a private key or a CSR?
No. It decodes X.509 certificates (-----BEGIN CERTIFICATE----- blocks). Private keys and certificate signing requests use different structures and aren't supported. Never paste a private key into any online tool.
Why do the SHA-1 and SHA-256 fingerprints differ?
They're two different hash functions applied to the same certificate bytes, so they produce different outputs. SHA-256 is the modern standard; SHA-1 fingerprints are shown because some older tools and dashboards still display them.