Get the weekly radar
One short email with the freshest products, every week.
Free online tool to decode X.509 certificates (PEM format). Instantly view details like issuer, subject, validity, SAN, and more. Secure decoding happens in your browser.
Grounded in available product and source data
This free online tool allows you to instantly decode X.509 certificates presented in the common PEM format. Simply paste the certificate content below, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers, and click "Decode Certificate".
You can extract and verify key details like the issuer, subject, validity period (not before/not after dates), serial number, signature algorithm, Subject Alternative Names (SAN), public key information, and certificate extensions.
An X.509 certificate is a standard digital document, defined by the ITU-T, used to prove the ownership of a public key. Think of it like a digital passport. It securely binds an identity (like a website's domain name, an organization, or an individual) to a cryptographic public key. This binding is verified by the digital signature of a trusted issuer.
If the signature is valid and the software using the certificate trusts the issuer, then the public key contained within can be reliably used for secure communication (like HTTPS/TLS), email encryption, code signing, or digital signatures.
The most common format for these certificates is defined in the X.509 standard, with specifics further detailed in RFC 5280.
In a typical Public Key Infrastructure (PKI), certificates are issued by a trusted entity called a Certificate Authority (CA). CAs are organizations responsible for verifying the identity of the entity requesting a certificate before issuing it. Many commercial CAs exist, but certificates can also be issued by internal CAs within an organization or even self-signed for testing or specific trust scenarios.
An X.509 certificate has a defined structure, usually containing the following key fields:
Note: Fingerprints (Thumbprints) like SHA-1 or SHA-256 are not part of the certificate itself. They are calculated hashes of the entire encoded certificate and used as unique identifiers.
