Subject and issuer, validity dates, public key type/size, extensions (SAN, key usage), signature algorithm, fingerprints (SHA-1, SHA-256). Everything needed to audit a cert.

Does it verify the cert?

No — it only parses. Verification (chain validation, revocation check) requires contacting CAs. Use openssl or a specific verifier for that.

PEM (BEGIN CERTIFICATE) and DER (binary, base64-encoded). Chains of multiple certs are decoded one by one.

Is my certificate private?

Runs entirely in your browser. Paste production certs safely — they don't leave your device.

Certificate Decoder | DevTools Surf

DevTools Surf

Example: Certificate Decoder

A worked example, rendered from real sample data. Sign in to run the tool on your own input.

Input

Output

═══ Certificate ═══
Subject: C=US, O=Example Ltd, CN=example.com
Issuer: C=US, O=Example Ltd, CN=Example Root CA
Serial: 6AD8C815E4BDCC1DC10569147DE786158CE57B21
Valid from: Sep 19 21:06:47 2026 GMT
Valid to: Oct 21 21:06:47 2027 GMT
Public key: RSA 2048-bit (e=65537)
Signature algorithm: sha256WithRSAEncryption
Certificate authority: no (end-entity)
Self-signed: no
Extended key usage: 1.3.6.1.5.5.7.3.1, 1.3.6.1.5.5.7.3.2

─── Fingerprints ───
SHA-1: EA:07:2D:42:48:A2:1B:84:C3:62:E4:67:F6:08:F4:24:17:70:DF:62
SHA-256: 7A:EC:30:17:4F:CB:10:10:E5:0E:45:68:B8:E4:B2:CF:98:1F:75:F5:D1:70:A9:C5:4F:DE:45:9A:C3:8E:F1:D6
SPKI pin (sha256/base64): KrQuR+XiPKTaIsqaodMLQ/kjmAo8h7CEPlExI3epc4g=

─── Subject alternative names (3) ───
• DNS:example.com
• DNS:www.example.com
• DNS:api.example.com

─── Validity ───
✓ Valid for another 396 day(s).
✓ No weak algorithms or obvious structural problems found.

About Certificate Decoder

Certificate Decoder preview - Networking tool

Decode X.509 PEM certificates into readable fields. Part of the DevTools Surf developer suite. Browse more tools in the Networking collection.

Use Cases

Checking SSL certificate expiration dates before renewal deadlines
Verifying SAN entries cover all required domain variations
Debugging TLS handshake failures by inspecting certificate fields
Auditing intermediate certificate chain completeness

Tips

Paste a PEM certificate to see expiry date and issuer details
Check the Subject Alternative Names for covered domains
Verify the certificate chain and key usage extensions

Fun Facts

X.509 was first published in 1988 by the ITU-T as part of the X.500 directory services standard.
Let's Encrypt, launched in April 2016, has issued over 4 billion certificates and made HTTPS free for everyone.
The first SSL certificate was issued by Netscape in 1994, and a single certificate could cost over $1,000 per year at that time.

FAQ

What does it show?: Subject and issuer, validity dates, public key type/size, extensions (SAN, key usage), signature algorithm, fingerprints (SHA-1, SHA-256). Everything needed to audit a cert.
Does it verify the cert?: No — it only parses. Verification (chain validation, revocation check) requires contacting CAs. Use openssl or a specific verifier for that.
Which cert formats?: PEM (BEGIN CERTIFICATE) and DER (binary, base64-encoded). Chains of multiple certs are decoded one by one.
Is my certificate private?: Runs entirely in your browser. Paste production certs safely — they don't leave your device.

Related Networking Tools

IP Address Lookup HTTP Status Reference DNS Record Explainer WebSocket Frame Decoder Port Reference Lookup MIME Type Lookup HPKP Generator User-Agent Parser