X.509 Certificate Decoder
Structurally decode a pasted PEM X.509 certificate locally, including names, validity fields, SPKI, and selected extensions.
This tool handles input and primary processing in your browser and is designed not to send the input to QuickKit’s server.
Avoid live production secrets; use dummy or masked data where possible. Data handling details
Certificate fields
How it works
Paste exactly one PEM block labelled CERTIFICATE. The decoder reads bounded definite-length DER using the RFC 5280 certificate layout: version, serial number, both signature-algorithm identifiers, issuer, subject, validity encodings, SubjectPublicKeyInfo, and selected extensions. It decodes basic constraints, key usage, subject alternative names, extended key usage, and subject key identifier only when each extension value has the expected complete DER form; other extension values remain unparsed. Within subject alternative names, otherName, x400Address, and ediPartyName entries are listed by type and size without decoding their contents, and the remaining entries still decode. It also reports a structural diagnostic when the TBSCertificate signature field and the outer signatureAlgorithm differ, which RFC 5280 forbids. This is structural inspection only: it does not verify the certificate signature, path, hostname, revocation, CT, OCSP, CRL, or whether the certificate is currently valid.