SSL/TLS Certificate Decoder

Securely decode X.509 PEM certificates purely in your browser. No data leaves your machine.

Failed to parse certificate: Cannot read properties of undefined (reading 'certificateFromPem')

Decoding SSL/TLS Certificates

X.509 certificates (commonly used for SSL/TLS encryption on the web) are typically distributed in Privacy Enhanced Mail (PEM) format, which is a Base64-encoded string wrapped in -----BEGIN CERTIFICATE----- tags. Because it's binary data encoded as text, you cannot read it directly.

Why Client-Side Parsing Matters

Many online tools allow you to paste certificates to decode them. However, if you accidentally paste a Private Key alongside your public certificate, that private key might be logged by their servers, compromising your entire security infrastructure.

This DevTools Suite Cert Decoder operates 100% locally in your browser using the Web Crypto API and `node-forge`. Your certificate data never leaves your machine.

What to Check in a Certificate

  • Validity Period (Not After): The exact date and time the certificate expires. Browsers will reject the site after this timestamp.
  • Subject Alternative Names (SANs): The modern standard for declaring which domain names are protected by the certificate. A single certificate can protect example.com, api.example.com, and admin.example.com if they are listed in the SANs extension.
  • Issuer: The Certificate Authority (CA) that signed the certificate (e.g., Let's Encrypt, DigiCert, GlobalSign).