PEM Certificate Decoder

Paste any PEM block — a certificate, a certificate signing request, or a key — and read its contents instantly: subject, issuer, serial number, validity dates, signature algorithm, key type, key length and SHA-256 fingerprint.

How to use

1. Paste a PEM block (including the -----BEGIN ...----- and -----END ...----- lines) into the input box, or click Load Sample Certificate to try a real one.
2. Click Decode. The tool detects the PEM type from the header and parses the Base64 body with a built-in ASN.1 reader.
3. Read the result table: for certificates you get subject, issuer, serial number, validity period, signature algorithm, key details, SANs and the SHA-256 fingerprint. For keys you get the key type and bit length.
4. Use Copy Results to copy the full summary as plain text.

What the fields mean

• Subject CN / Issuer CN: the Common Name of the certificate owner and of the authority that signed it. If they match, the certificate is self-signed.
• Serial number: the unique identifier assigned by the issuer, shown in hexadecimal.
• Valid from / Valid until: the time window in which the certificate is trusted. A certificate outside this window will be rejected by browsers.
• Signature algorithm: the hash + public-key algorithm used to sign the certificate, e.g. sha256WithRSAEncryption.
• SHA-256 fingerprint: a hash of the whole certificate, useful to verify that the certificate you hold is exactly the one a server presents.

Limitations

• Encrypted private keys (ENCRYPTED PRIVATE KEY, password-protected PEM files) are detected but cannot be decoded without the password.
• OpenSSH-format keys (-----BEGIN OPENSSH PRIVATE KEY-----) are detected but their proprietary binary format is not parsed here.
• Only the first PEM block in the input is decoded; certificate chains are out of scope.