Paste an SSL/TLS certificate below, or open a certificate file, to see what is inside it: the domain names it covers, who issued it, when it expires and how strong its key is. Cert Decoder reads X.509 certificates as PEM text (the block that starts with -----BEGIN CERTIFICATE-----) and as .pem, .crt, .cer or .der files in either PEM or binary DER encoding.
Paste or drop a PEM certificate below, or open a .pem, .crt, .cer or .der file
The decoder takes either PEM text (a block that starts with -----BEGIN CERTIFICATE-----) or a certificate file. Where to get it depends on where the certificate lives:
.pem, .crt, .cer, .der): press Open certificate file or drop the file on the box. Text (PEM) and binary (DER) files both work, and the file is read by your browser, not uploaded. A .pfx, .p12 or .p7b bundle has to be converted first (see below).openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509Add
-showcerts after s_client to print the intermediate certificates as well.Paste the PEM block into the box above and press Decode Certificate; an opened file is decoded straight away. If you paste or open a whole chain, only the first certificate is decoded, so put the one you care about first. Each row of the result means:
www.example.com.The status line compares the validity dates with your computer's clock and nothing else. It does not check that the certificate was signed by a trusted CA, that it matches a particular website, or that it has not been revoked. A certificate can be date-valid and still be rejected by a browser.
*.example.com covers one level of subdomains only.Certificate lifetimes are getting shorter. Since 15 March 2026, publicly trusted TLS certificates can be valid for at most 200 days. The limit drops to 100 days in March 2027 and to 47 days in March 2029, so renewals that used to happen once a year will happen every few weeks.
PEM and DER are two encodings of the same certificate. DER is the raw binary form. PEM is that binary encoded as Base64 text between BEGIN and END lines, which is why it can be pasted into a web page or an email.
.crt, .cer and .pem are only file name extensions and can hold either encoding. This decoder accepts both, so you do not need to know which one you have. For other tools, or for bundle formats, convert to PEM with OpenSSL:
openssl x509 -inform der -in certificate.cer -out certificate.pem
.p7b, .p7c) to PEM: openssl pkcs7 -print_certs -in bundle.p7bAdd
-inform der if the bundle is binary..pfx, .p12) to PEM, certificate only: openssl pkcs12 -in bundle.pfx -nokeys -clcertsThese files also contain the private key;
-nokeys leaves it out. This decoder never needs a private key, so never paste one.SSL/TLS certificates are X.509 certificates: a format defined by the ITU-T and profiled for the internet in RFC 5280. A certificate is a signed statement from a CA that a public key belongs to a named owner. Version 3, used by practically every certificate today, has these parts:
| Field | What it holds | Shown here as |
|---|---|---|
| Version | The X.509 version, almost always v3. | Not shown |
| Serial number | A number unique among the certificates from one CA. | Serial Number |
| Signature algorithm | How the CA signed it, for example sha256WithRSAEncryption or ecdsa-with-SHA256. | Not shown |
| Issuer | The distinguished name of the signing CA. | Issuer |
| Validity | The notBefore and notAfter dates. | Valid From, Valid To |
| Subject | The distinguished name of the owner. | Subject, plus one row per name part (CN, O, OU, L, ST, C, E) |
| Subject public key info | The owner's public key and its algorithm. | Key Size |
| Extensions | Extra data such as Subject Alternative Names, key usage, whether it is a CA, and where to check revocation. | Subject Alternative Names only |
| Signature | The CA's signature over all of the above. | Not shown |
Fingerprints such as SHA-256 thumbprints are not stored in the certificate. They are hashes of the whole DER-encoded certificate, calculated by whatever software displays them; this decoder shows them in the last two rows.
Yes. A certificate is public: a server sends it to everyone who connects. Decoding runs in JavaScript inside your browser, and nothing you paste or open is uploaded. The page's analytics count that a certificate was decoded, never what it contained. Never paste a private key: the decoder does not need one, and if an opened file contains one it is left out of the box.
Decode it and read the Valid To row; the status line above the table also says whether it has expired. For a live website you can print just the expiry date with OpenSSL:
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -enddate
Not on this page. Web pages cannot read the raw certificate of another website, so a URL cannot be fetched and decoded here. Get the certificate with OpenSSL or export it from your browser's certificate viewer, as described under How to decode an SSL certificate, then paste or open it here.
The status line checks the dates only. Other common causes: the address you visit is missing from Subject Alternative Names; the server does not send its intermediate certificate, so the browser cannot link the certificate to a trusted root; the certificate is self-signed or issued by a private CA the device does not trust; or the CA has revoked it.
No, it decodes certificates only. A certificate signing request (CSR, starting with -----BEGIN CERTIFICATE REQUEST-----) can be read with openssl req -in request.csr -noout -text. A private key should stay on the server it belongs to; do not paste it into any website.
Try StatusAlert – SSL certificate expiry monitoring, 100% free while in beta.
Try it free