Decoded in your browser. The text you paste is never uploaded.
How to use it
- Paste the PEM text, including the -----BEGIN … ----- and -----END … ----- lines. A whole chain of certificates works too.
- The decoded fields appear as soon as the text is complete.
- Check the subject, the Subject Alt Names and the key size before you submit a CSR or install a certificate.
What the result means
- Subject is who the certificate is for: CN (common name), O (organisation), C (country) and so on. EV certificates add the business category and jurisdiction.
- Subject Alt Names list every host name (and IP) the certificate covers. Browsers only check this list; the CN alone isn't enough.
- Issuer (certificates only) is the CA that signed it.
- Valid from / until are the dates the certificate works between, with the days left.
- Public key shows the algorithm and size: RSA 2048-bit or larger, or an EC curve such as P-256.
- SHA-256 fingerprint uniquely identifies this exact certificate; compare it with what your server or browser shows.
Decoding happens entirely in this page. Never paste a private key; you don't need it to decode a CSR or a certificate.
Frequently asked questions
What is a CSR?
A certificate signing request: a file you send to a certificate authority. It contains your public key and the names the certificate should cover, signed with your private key to prove you hold it. The CA returns a certificate built from it.
Is it safe to paste my CSR or certificate here?
Yes. Both are public by design, and this page decodes them in your browser without uploading anything. Never paste a private key into any website.
How do I decode a CSR on a Mac?
In Terminal: openssl req -in request.csr -noout -text. For a certificate: openssl x509 -in cert.pem -noout -text. Both work with the LibreSSL build that ships with macOS.
Why isn't my CN enough for the browser?
Since 2017, browsers only match host names against the Subject Alternative Name extension. Make sure every name you need, including www and the bare domain, is listed there.
Can this check a live website's certificate?
No, it only decodes text you paste. To grab a site's certificate on a Mac, run: openssl s_client -connect example.com:443 -servername example.com, then paste the certificate part here.