Certificate Decoder
Read an SSL certificate — who it is for, when it expires, and what it covers.
Loading the decoder…
About the Certificate Decoder converter
Certificates are readable, but not by people. The usual answer is a long openssl incantation nobody remembers, or pasting the certificate into a website — which works, but means handing it to somebody else's server.
This reads it on your own machine. Paste the block beginning BEGIN CERTIFICATE and everything comes out in plain language, including the answer most people came for: when does it expire.
Expiry first, because that is the question
Nearly every visit to a tool like this is somebody checking whether a certificate has run out, or is about to. So that goes at the top as a count of days rather than a date to work out for yourself, and it is coloured according to how worried to be.
The start date matters too, and catches people out less often than it should — a certificate issued for a future date is not yet valid, and the error a browser shows for that looks much like the error for an expired one.
The names are what browsers actually check
The common name is the field everybody looks at, and it has not been what browsers check for years. Hostnames are matched against the subject alternative names, and a certificate without any will be rejected however correct its common name looks.
Those names are listed here in full, including IP addresses where present, so you can see exactly what the certificate covers rather than inferring it.
How it is read
A certificate is DER — a tag, a length, a value, nested — wrapped in base64 with a header and footer. Walking that structure is straightforward enough to do directly, which is why this needs no library and no server.
The SHA-256 fingerprint is calculated with the browser's own hashing, and matches what a browser or openssl shows for the same file, so it can be compared against one you have been given.
Frequently asked questions
Is my certificate uploaded?
No. It is decoded in your browser and never sent anywhere. Certificates are public by design, so this matters less than with a private key — but pasting things into other people's servers is a habit worth not having, and it means this works offline.
Can I paste a private key?
Please do not, and it will not work anyway — this reads certificates, not keys. A private key should never be pasted into any website, including this one.
What is a self-signed certificate?
One where the subject and the issuer are the same, meaning it vouches for itself rather than being signed by an authority a browser trusts. Fine for local development and internal use; browsers will warn about it anywhere else. It is called out here when it applies.
Why does my certificate show no alternative names?
Older certificates sometimes relied on the common name alone. Modern browsers ignore the common name entirely for hostname matching, so a certificate with no subject alternative names will not be accepted for any site.
Which formats can it read?
PEM, which is the base64 block between BEGIN CERTIFICATE and END CERTIFICATE, and the .crt and .cer files that usually contain it. Binary DER files and PKCS#12 bundles are not read here.