Is my certificate uploaded anywhere?

No. It is decoded in your browser and there is no API endpoint that could receive it. That is the reason this tool exists — a certificate is public, but the box people paste it into is the same box they eventually paste a private key into.

Does it verify the certificate chain?

No. It reads what is inside a single certificate and checks the facts it can check by itself. Whether it chains to a trusted root, and whether the signature is genuine, needs the issuer certificates and is deliberately out of scope.

Why does it say self-signed without verifying anything?

Because subject and issuer being identical is a strong hint and a cheap check, while verifying the signature is not. The report says which one it did, so it is never mistaken for the other.

API & Security

X.509 Certificate Decoder — SSL/TLS Certificate Viewer

Paste a PEM certificate to read what is inside it. Nothing is uploaded — the parsing happens on your machine, which is the point of this one existing.

Certificate0 lines

This tool runs entirely in your browser. Your input is never uploaded, stored or logged.

How it works

The PEM body is base64-decoded to DER and walked as ASN.1. DER is tag-length-value all the way down, and the fiddly parts are the long-form length, which most quick parsers get wrong above 127 bytes, and object identifiers, whose first two components are packed into a single byte. Fingerprints are SHA-1 and SHA-256 over the raw DER, computed here rather than taken from anywhere, and they match what openssl prints byte for byte — that is asserted by a test against certificates openssl generated.

A private key is detected and refused before anything is parsed. A certificate is public by design and a private key is not, the two look alike at a glance, and the same box is where somebody eventually pastes the wrong one. Every other decoder on the web asks you to send it the file; this one cannot, because there is no server involved and no endpoint to send it to.

Beyond the fields, the things worth being told are checked: expiry and not-yet-valid against a date you control, SHA-1 and MD5 signatures, RSA keys under 2048 bits, a validity period over the 398 days browsers now permit for publicly trusted leaf certificates, and a missing subjectAltName — browsers stopped honouring the common name for hostname matching in 2017, so a certificate without SANs matches no host at all.

Common problems

Every example below is run against this tool in our test suite, so what it says here is what the tool actually does.

That is a private key, not a certificate.

-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBg==
-----END PRIVATE KEY-----

Why:: A key and a certificate are both PEM blocks of base64 and look identical at a glance. The header is the only thing that distinguishes them, and it is the part people skim past.
Fix:: Paste the file whose header says CERTIFICATE. If a private key has been pasted anywhere online, treat it as compromised and reissue.

That is valid DER but not an X.509 certificate.

aGVsbG8gd29ybGQ=

Why:: The base64 decoded successfully but the bytes underneath are not a certificate structure. Usually the wrong part of a bundle was copied, or a chain file was pasted with its own armour lines included.
Fix:: Copy from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE----- inclusive, one block at a time.

The browser rejects the certificate but the common name looks right.

Why:: The common name has not been used for hostname matching since 2017. Only the subjectAltName extension counts, and a certificate without one matches nothing regardless of its CN.
Fix:: Reissue with every hostname listed in subjectAltName. The decoder shows what is actually in there.

Frequently asked questions

Is my certificate uploaded anywhere?: No. It is decoded in your browser and there is no API endpoint that could receive it. That is the reason this tool exists — a certificate is public, but the box people paste it into is the same box they eventually paste a private key into.
Does it verify the certificate chain?: No. It reads what is inside a single certificate and checks the facts it can check by itself. Whether it chains to a trusted root, and whether the signature is genuine, needs the issuer certificates and is deliberately out of scope.
Why does it say self-signed without verifying anything?: Because subject and issuer being identical is a strong hint and a cheap check, while verifying the signature is not. The report says which one it did, so it is never mistaken for the other.