Paste an SSL/TLS certificate or a CSR in PEM and see CN, SANs, issuer, validity, algorithm and fingerprints, all in the browser.
An SSL/TLS certificate is an X.509 structure encoded in DER and wrapped in base64 (PEM). Behind that -----BEGIN CERTIFICATE----- block are important fields: who the certificate was issued to (Subject/Common Name), which domains it covers (Subject Alternative Names), who issued it (Issuer), how long it is valid, the public key type and size (RSA 2048, EC P-256…), the signature algorithm and the fingerprints that uniquely identify it. This tool decodes all of that, and also CSRs (PKCS#10), the file you generate to request a certificate, using a built-in ASN.1 parser, with no external libraries. The SHA-256 and SHA-1 fingerprints are computed with the browser's WebCrypto. It's ideal for checking a certificate before installing it, validating the SANs in a CSR or diagnosing validity and chain errors.
Paste the code into your HTML and the tool shows up on your page, without J-Kit's navigation and ads. It still runs in the browser of whoever visits your site.
<iframe
src="https://jkit.tools/embed/en-US/ssl-certificate-decoder"
width="100%"
height="600"
style="border:0"
loading="lazy"
title="SSL/CSR Certificate Decoder"
></iframe>These references help contextualize formulas, standards, APIs and limitations used on this page. They do not replace professional validation when a result has legal, financial, medical or operational impact.
A CSR (Certificate Signing Request) is the request you generate with your private key and send to the Certificate Authority; it contains the Subject and the public key but hasn't been signed by anyone yet. The certificate is the result: the CSR after it's signed by the CA, with issuer, validity and the signature. This tool decodes both.
Paste the content between -----BEGIN CERTIFICATE----- and -----END----- (or a CSR, -----BEGIN CERTIFICATE REQUEST-----). X.509 decoding happens in the browser.
The tool decodes X.509 certificates and certificate signing requests (CSR) in PEM, showing the subject, the covered domains (SAN), the issuer, the validity, the key size and type, the signature algorithm and the fingerprints. Nothing is sent outside the browser.
For privacy, the ASN.1/X.509 decoding and the fingerprint computation run entirely in your browser via WebCrypto. The pasted certificate is never sent to any server, useful even for internal or client certificates.