Runs in your browser. Your files and text never leave your device - nothing is uploaded.
Decode a CSR or SSL Certificate Online
The Tools Kit’s free CSR / Certificate Decoder turns a PEM block into readable fields. Paste a certificate signing request and you see the subject it was generated for, its public key and its signature algorithm. Paste an X.509 SSL/TLS certificate and you also get the issuer, serial number and validity dates, so you can confirm what a file contains before you submit or install it.
Decoding happens in your browser with the open-source jsrsasign library, so the text you paste is never uploaded. If you want to look at the certificate a live website is serving rather than a file you have, the SSL certificate checker connects to the domain and reports its certificate, protocol and days until expiry.
How to Use the CSR / Certificate Decoder
- 1
Copy the PEM block
Open your .csr, .crt or .pem file in a text editor and copy the whole block, including the -----BEGIN CERTIFICATE REQUEST----- or -----BEGIN CERTIFICATE----- line and the matching END line.
- 2
Paste it into the box
Paste the text into the PEM Certificate or CSR box. The tool reads the header to decide whether it is a certificate signing request or an X.509 certificate.
- 3
Click Decode
Press Decode. The block is parsed in your browser, and the result is labeled either Certificate Signing Request (CSR) or X.509 Certificate.
- 4
Check the fields
For a CSR, review the subject, public key and signature algorithm. For a certificate, review the subject, issuer, serial number, Not Before and Not After dates, and signature algorithm. Use Clear to start over.
The decoder accepts PEM text only. A binary DER file (often .der or .cer) has to be converted to PEM first, for example with openssl x509 -inform der -in cert.der -out cert.pem.
What the Decoder Shows for a CSR and a Certificate
The tool looks at the header first. Text containing CERTIFICATE REQUEST is read as a CSR; any other text containing CERTIFICATE is read as a certificate; anything else gets an error rather than a guess.
| Field | CSR | X.509 certificate |
|---|---|---|
| Subject | Yes | Yes |
| Issuer | Not applicable | Yes |
| Serial number (hex) | Not applicable | Yes |
| Not Before / Not After | Not applicable | Yes |
| Public key | Type, plus bit length for RSA | Not shown |
| Signature algorithm | Yes | Yes |
The subject appears as a distinguished name such as /C=US/ST=CA/O=Example/CN=www.example.com, where CN is the common name (usually the hostname), O the organization, ST the state and C the two-letter country code. Check these carefully before ordering a certificate: a typo in the common name means the issued certificate will not match your domain. If you are unsure which hostname a site resolves under, the DNS lookup shows its records, and the WHOIS lookup shows who registered the domain, which helps when an organization-validated certificate asks for matching company details.
The decoder deliberately keeps to these core fields. It does not list subject alternative names or other extensions, and it does not verify signatures, chains or revocation status.
Reading Certificate Validity Dates
Not Before and Not After are shown exactly as they are stored in the certificate, in UTC. Most certificates use the 13-character UTCTime form YYMMDDhhmmssZ. For example, 261001211319Z splits into 26-10-01 21:13:19 and means 1 October 2026 at 21:13:19 UTC. Two-digit years from 00 to 49 belong to 2000-2049 and 50 to 99 to 1950-1999; dates from 2050 on use the four-digit GeneralizedTime form, such as 20500101000000Z.
A certificate is only valid between those two instants. Comparing Not After with today’s date tells you whether it has expired, and comparing it with your renewal calendar tells you how much time you have left. Because the times are UTC, a certificate ending at 00:00:00Z on the first of the month expires on the evening of the previous day across the Americas.
Inside a PEM File
A PEM block is binary ASN.1 (DER) data encoded as Base64 text and wrapped in BEGIN and END lines. You could strip the header and run the body through the Base64 decoder, but the result is raw binary structure; this tool parses that structure and labels each field for you. It works much like the JWT decoder does for JSON Web Tokens: both read signed data and show what it says without checking that the signature is trustworthy.
A certificate’s fingerprint is a hash of its DER bytes, usually SHA-256, and it is not part of this decoder’s output. If you are comparing a fingerprint someone sent you and are not sure which hash it is, the hash identifier can suggest the algorithm from its length and format.
Common uses
- Checking the common name and organization in a CSR before sending it to a certificate authority
- Confirming that a CSR uses an RSA key of the size your CA requires, such as 2048 bits
- Reading the Not After date of a certificate file to plan its renewal
- Identifying which authority issued a certificate and noting its serial number for a revocation request
- Telling apart several .pem or .crt files on a server by their subject and issuer
For more lookup, hashing and token utilities, browse all security tools.
Certificate terms explained
| Term | What it means here |
|---|---|
| CSR | Certificate Signing Request: the file you send to a certificate authority, holding your public key and the subject details you want certified |
| X.509 | The standard format for public key certificates used by TLS/SSL, code signing and S/MIME |
| PEM | Base64-encoded data wrapped in -----BEGIN ...----- and -----END ...----- lines; the text format this tool accepts |
| Subject / DN | The distinguished name the certificate or request is for, built from parts such as C (country), ST (state), O (organization) and CN (common name) |
| Issuer | The distinguished name of the certificate authority that signed a certificate; equal to the subject on a self-signed certificate |
| Serial number | A number the issuing CA assigns to each certificate, shown here in hexadecimal; it is how revocation lists identify a certificate |
| Not Before / Not After | The start and end of a certificate’s validity period, stored as UTC timestamps |
| Signature algorithm | The hash and key algorithm used to sign the CSR or certificate, such as SHA256withRSA or SHA256withECDSA |
Frequently Asked Questions
Copy the full CSR, from -----BEGIN CERTIFICATE REQUEST----- to -----END CERTIFICATE REQUEST-----, paste it into the box and click Decode. The tool shows the subject distinguished name, the public key type (with the bit length for RSA keys) and the signature algorithm.
Yes. Paste a PEM certificate starting with -----BEGIN CERTIFICATE----- and the tool shows its subject, issuer, serial number in hexadecimal, Not Before and Not After dates, and signature algorithm. The same box handles both certificates and CSRs.
No. The decoder loads the jsrsasign library into your browser and parses the PEM text there; no request containing your data is sent. CSRs and certificates only hold public information anyway, but nothing you paste leaves your device.
No, and you should never paste a private key into any website. A CSR contains your public key and subject details, signed with the private key, but not the key itself. If you paste a block that starts with BEGIN PRIVATE KEY, the tool rejects it as not a certificate or CSR.
They are shown in the raw ASN.1 time format, in UTC. A 13-character value such as 261001211319Z is YYMMDDhhmmssZ and means 1 October 2026 at 21:13:19 UTC; two-digit years 00-49 are 2000-2049 and 50-99 are 1950-1999. Dates from 2050 onward use a four-digit year, as in 20500101000000Z.
Decode the certificate and read the Not After field; that is the expiry moment in UTC. The decoder does not count the days remaining for you. To check the certificate a live website is actually serving, including days until expiry, use an SSL checker on the domain instead.
No. It shows the subject, public key and signature algorithm for a CSR, and the subject, issuer, serial number, validity dates and signature algorithm for a certificate. Extensions such as subject alternative names, key usage and fingerprints are not displayed.
The bit length is reported for RSA keys only, for example RSA (2048-bit). For an elliptic-curve CSR the tool shows the key type, EC, without the curve name or size. If the public key cannot be parsed at all, the field shows N/A.
No. It decodes and displays the fields but does not check the signature, build the chain to a trusted root, check revocation or compare the dates with today. It is a reader for the contents of a PEM block, not a validator.
The text must include a BEGIN line containing CERTIFICATE or CERTIFICATE REQUEST and the complete Base64 body. A truncated or edited block produces a parsing error such as "too short ASN.1 value". The older -----BEGIN NEW CERTIFICATE REQUEST----- header is not accepted; remove the word NEW from both the BEGIN and END lines and decode again.
You can, but only the last certificate in the pasted text is decoded. In a typical full-chain file the server (leaf) certificate comes first and the intermediate last, so the result will usually describe the intermediate. To inspect the leaf or any other certificate, paste that block on its own.
Reviewed by Raja Jahangir · Last reviewed: October 7, 2026
How do you decode a CSR or SSL certificate?
To decode a CSR or certificate, paste the PEM block starting with BEGIN CERTIFICATE or BEGIN CERTIFICATE REQUEST. A certificate shows its subject, issuer, serial number, validity dates and signature algorithm; a CSR shows its subject, public key type, RSA key size and signature algorithm. Decoding runs in the browser, so nothing is uploaded.
What is the difference between a CSR and a certificate?
A certificate signing request is what you generate and send to a certificate authority: it contains your public key and the subject details you want certified, signed with your private key. A certificate is what the authority sends back, adding its own issuer name, a serial number, validity dates, and its signature.