What can I paste into it?

PEM with any BEGIN label, raw base64, or hex with or without colons and spaces. Hex is accepted because that is how DER appears in a packet capture or a log line.

Does it understand certificates specifically?

It recognises a few common shapes and says what the outer structure looks like, but it reads structure rather than meaning. For a certificate in particular, the certificate decoder here gives you the named fields.

Why does it refuse indefinite-length encoding?

Because DER forbids it. Accepting it would mean this tool parses things that real DER parsers will reject, which is the opposite of useful when you are trying to work out why a parser rejected something.

API & Security

ASN.1 DER Inspector — Read Any DER Structure

Paste PEM, base64 or hex to see the ASN.1 tree underneath it — tags, lengths, byte offsets and decoded values. It works on formats it has never heard of.

DER1 line

8 bytes3 nodesLooks like a SEQUENCE; the structure below is all this tool can say for certain.

Structure

0000 SEQUENCE (6)
0002 INTEGER (1) 1 (0x01)
0005 INTEGER (1) 2 (0x02)

This tool runs entirely in your browser. Your input is never uploaded, stored or logged.

How it works

Certificates, private keys, CSRs, OCSP responses and PKCS#7 bundles are all ASN.1 DER underneath, and when one of them will not load the error is usually "asn1: structure error" with no indication of where. Seeing the tree answers that immediately: which node is truncated, which length runs past the data, which optional field is missing. Nothing free shows you this, so the options have been installing a toolchain or pasting the blob into a site that keeps it.

DER is tag-length-value, recursively. Each node here reports its tag, whether it is constructed, the length of its value, and its byte offset into the decoded data — the offset being the part that lets you line the tree up against a hex dump. Long-form lengths are handled properly, which matters because anything over 127 bytes uses them and a parser that reads the first length byte literally truncates every real structure. Indefinite-length encoding is rejected outright: it is legal in BER and forbidden in DER, so a structure using it is either not DER or has been through something that re-encoded it badly.

It reports structure, not meaning. Object identifiers, times, strings, booleans and integers are decoded, and a handful of common OIDs are named inline so the tree reads without a lookup, but the tool does not know what any particular document is for. That is deliberate — it is what lets it work on a format that did not exist when it was written.

Common problems

Every example below is run against this tool in our test suite, so what it says here is what the tool actually does.

A value claims to be longer than the data that follows it.

30 05 02 01 01

Why:: A node declares more content than remains. Almost always the input was truncated — copied from a terminal that wrapped, or cut at a column limit somewhere upstream.
Fix:: Re-copy the whole blob. The offset in the error tells you how far the structure got before it ran out.

Indefinite-length encoding is not valid DER.

30 80 02 01 01 00 00

Why:: A length byte of 0x80 means "ends with two zero bytes", which BER allows and DER forbids. Something in the chain re-encoded the structure, or it was never DER.
Fix:: Re-export in DER form. openssl will do this: openssl asn1parse -inform BER -out fixed.der.

A certificate parses in one tool and not another.

Why:: Usually a long-form length. Anything over 127 bytes encodes its length across several bytes, and a parser that reads the first byte as the length itself silently truncates.
Fix:: Compare the tree here against what the failing parser reports. The byte offsets say exactly where the two disagree.

Frequently asked questions

What can I paste into it?: PEM with any BEGIN label, raw base64, or hex with or without colons and spaces. Hex is accepted because that is how DER appears in a packet capture or a log line.
Does it understand certificates specifically?: It recognises a few common shapes and says what the outer structure looks like, but it reads structure rather than meaning. For a certificate in particular, the certificate decoder here gives you the named fields.
Why does it refuse indefinite-length encoding?: Because DER forbids it. Accepting it would mean this tool parses things that real DER parsers will reject, which is the opposite of useful when you are trying to work out why a parser rejected something.