PEM decoder

Decode a certificate file without touching the server.

Use this when you have a public certificate file, vendor-provided fullchain, or internal/private certificate evidence and need to understand what it contains before deployment or handoff.

Decode certificateRead monitoring guide

Decoder workspace

Decode a PEM certificate or fullchain

Paste public certificate PEM blocks to inspect identity, SANs, validity, key, extensions, and fingerprints without probing a hostname.

Paste one certificate or a fullchain PEM. Private keys are rejected and should never be pasted into this tool.

Local decodeDecoded issuer, subject, SANs, serial, validity, key, extensions, and fingerprints will appear here without probing the hostname.
PasteAdd certificate PEM

Use a leaf certificate or fullchain copied from a file, vendor portal, or ticket.

DecodeRead identity fields

Review subject, issuer, SANs, validity, serial number, key, and extensions.

CompareCopy fingerprints

Use SHA fingerprints and serial numbers to compare certificate versions.

VerifyCheck live serving later

After deployment, run the public checker to confirm customers receive the expected certificate.

Decoder intent

Use this before the certificate is live or when the endpoint is private.

The PEM decoder is for certificate-file review and handoff work. It answers what a certificate contains, which names it covers, and which identifiers prove whether two PEM files are the same.

IssuerThe authority that issued the certificate.
SubjectThe certificate identity encoded in the PEM.
SAN listThe hostnames and wildcard names covered by the certificate.
Serial numberA CA-issued identifier for comparing certificate versions.
SHA fingerprintsIdentity values for before-and-after checks.
ExtensionsKey usage, EKU, and CA flags that affect how the certificate should be used.
Section 01

Inspect certificate files and fullchains

A hostname probe only works when the certificate is already live and publicly reachable. The decoder handles the earlier workflow: paste a public PEM block and inspect the certificate before it is served.

  • Decode a leaf certificate before installing it.
  • Decode a fullchain to review leaf and intermediate order.
  • Decode internal or private certificate evidence without exposing private keys.
Section 02

Read identity and extension fields

The decoded result shows the fields teams usually need for renewal reviews, support tickets, and vendor handoffs: subject, issuer, SANs, serial number, validity, key algorithm, key usage, extended key usage, CA flag, and fingerprints.

  • Use SANs to confirm hostname and wildcard coverage.
  • Use serial number and fingerprints to compare versions.
  • Use key usage and EKU to catch certificates that are not appropriate for TLS server use.
Section 03

Keep private keys out of the workflow

The decoder is intentionally certificate-only. It rejects private key PEM blocks because key material should not be pasted into browser tools, support tickets, or chat threads.

  • Paste only BEGIN CERTIFICATE blocks.
  • Use the decoded report for tickets and inventory notes.
  • Use the live checker after deployment to confirm the public endpoint serves the expected certificate.
Keep history when identity matters

A decoder identifies the file. Monitoring remembers what went live.

Use the decoder before deployment, then add monitoring when issuer, SAN, fingerprint, or expiry changes should stay visible on the public endpoint.

Run SSL checkerView pricing
FAQ3 answers

  1. What does the certificate decoder show?

    It decodes public X.509 certificate fields from pasted PEM blocks, including issuer, subject, SANs, serial number, validity dates, signature and key details, extensions, and SHA-1/SHA-256 fingerprints.

  2. Can I decode a certificate before it is live?

    Yes. Paste the public certificate or fullchain PEM and the decoder inspects the file locally in the browser without connecting to the hostname.

  3. Can I paste a private key?

    No. The decoder rejects private key PEM blocks. Use only public certificate blocks and keep private keys inside your certificate manager or server environment.

Related5 pagesFree SSL certificate checkerRun the full public TLS diagnostic.Run free SSL checker
ToolOpenSSL certificate workbenchGenerate commands and parse terminal output for live or private checks.FeatureSSL expiry monitoringTurn important lookup targets into monitored hostnames.GuideSSL certificate monitoring guideBuild a practical monitored hostname list.PricingPricingChoose coverage by hostname count.