Certificate Decoder

What is an X.509 Certificate?

An X.509 certificate is the digital document that powers HTTPS and TLS. It binds a public key to an identity — a domain name, organization, or person — and is signed by a trusted Certificate Authority (CA) so that anyone can verify the binding. When your browser shows a padlock, it has validated the site's X.509 certificate against this chain of trust.

Certificates are usually stored and shared in PEM format: a Base64-encoded block wrapped between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers. This decoder parses that block locally in your browser and shows you everything inside it.

How to Use This Tool

1. Copy your certificate, including the BEGIN/END lines, and paste it into the box.
2. Click Decode Certificate.
3. Review the subject, issuer, validity window, Subject Alternative Names, key type, and fingerprints.

What the Fields Mean

• Subject — Who the certificate is issued to (includes the domain for a website).
• Issuer — The CA that signed it. Equal to the subject for a self-signed certificate.
• Valid From / Valid To — The window during which the certificate is trusted. An expired certificate triggers browser warnings.
• Subject Alternative Names — Every host name the certificate covers; browsers check these, not the Common Name.
• Serial Number — A unique identifier assigned by the issuing CA.
• Signature Algorithm — The algorithm used to sign the certificate (e.g. SHA-256 with RSA).
• Fingerprint — A hash of the whole certificate, used to identify or pin it precisely.

Common Uses

Use a certificate decoder to confirm a certificate covers the right domains before deploying, to check expiry dates, to verify a CSR was issued correctly, to read the SANs on a multi-domain certificate, or to grab the SHA-256 fingerprint for certificate pinning. It is also handy for troubleshooting chain and trust problems where you need to see exactly who signed what.