IT Buddy
Menu
NetworkingSecurityCloudLinux & DevOpsUtilitiesMicrosoft Soon
All toolsMy toolsWhat's newAbout

X.509 certificate decoder

Decode a PEM or DER X.509 certificate: subject, issuer, validity dates, public key, Subject Alternative Names and extensions.

Runs in your browser · nothing is sentHashing & cryptoNew

How to use

  1. Paste the certificate, including the -----BEGIN CERTIFICATE----- lines if present.
  2. Read the subject, validity dates and Subject Alternative Names.
  3. Check the days remaining before it expires.

Common scenarios

Checking when a certificate expires

Paste the certificate to see the exact expiry date and how many days are left.

Verifying which domains a certificate covers

Check the Subject Alternative Names list to see every domain the certificate is valid for, not just the subject.

About this tool

Paste a certificate in PEM format (starting with -----BEGIN CERTIFICATE-----) or raw base64/hex DER, and the tool decodes the ASN.1 structure to show the subject, issuer, validity period, public key algorithm and length, Subject Alternative Names and the standard extensions. Everything is decoded locally; nothing is sent anywhere, and no certificate authority or revocation check is performed.

🔒 Your input stays in your browser and is never sent anywhere.

Frequently asked questions

Does this check if the certificate is trusted or revoked?

No. It only decodes and displays the fields stored in the certificate itself. It does not verify the signature chain, check revocation (CRL/OCSP), or confirm the certificate is trusted by any browser.

What is a Subject Alternative Name?

A list of additional names (domains, IP addresses) the certificate is valid for. Modern browsers check this list instead of the subject field to decide if a certificate matches a website.

Why does it say the certificate is self-signed?

That means the issuer and subject are identical: the certificate was signed with its own private key rather than by a separate certificate authority. This is normal for root CAs and for test certificates, but a browser will not trust a self-signed certificate by default.

What to do next

Also useful

  • DMARC analyzerCheck a DMARC record: policy, subdomain policy, pct and report addresses, with a diagram of what receivers do. Look it up in DNS or paste records.
  • AWS Security Group analyzerPaste a describe-security-groups export to find open ports, redundant and shadowed rules, see a traffic diagram and the impact of removing a rule.
  • IAM Policy analyzerPaste an AWS IAM policy to find overly broad permissions, privilege escalation paths and confused-deputy risks, and simulate requests.

Found a problem or have a suggestion? Tell us