About this tool
An X.509 certificate is the standard format behind HTTPS, code signing, client authentication, and most other public-key infrastructure (PKI) on the internet. Underneath the padlock icon a browser shows you, it is a strictly structured ASN.1 document, binary-encoded with DER (Distinguished Encoding Rules) and then wrapped in Base64 between `-----BEGIN CERTIFICATE-----` / `-----END CERTIFICATE-----` markers so it can be copied and pasted as plain text — that combination is what everyone calls "PEM".
This decoder ships its own minimal DER/ASN.1 reader, written from scratch with zero external certificate libraries, to walk that binary tree and surface the fields people actually care about: who the certificate was issued to (Subject) and by whom (Issuer), its serial number and X.509 version, the validity window it is stamped with, and the algorithms used both to sign it and to generate its public key. It flags certificates that are self-signed (issuer and subject match) and ones that have already expired.
Everything runs locally in your browser — the certificate text you paste is parsed on your machine and never leaves it. That makes this a safe way to inspect a certificate pulled from a server, a CI pipeline artifact, or a `.pem`/`.crt` file before you decide whether to trust it, without pasting sensitive infrastructure details into a third-party service.
Frequently asked questions
What does "self-signed" mean and is it a problem?
A self-signed certificate has the same issuer and subject — it wasn't vouched for by a trusted Certificate Authority. That's normal and fine for local development, internal tools, or testing, but browsers will show a trust warning for it on a public website, since anyone could have created it.
Is my certificate data uploaded anywhere?
No — the pasted PEM text is parsed entirely by hand-written JavaScript running in your browser tab. Nothing is sent to any server, which matters since certificates can sometimes contain internal hostnames or other sensitive metadata.