ToolsWeb & certificates

Certificate decoder

Paste a certificate, a whole chain or a certificate request (CSR) to see its names, dates, key, extensions and fingerprints. Chains are put in order and every signature is checked.

Runs entirely in your browser

Certificate

How this works

Everything happens in this page's JavaScript, on your device. It finds each PEM block, or reads the file you chose, and turns the Base64 back into DER bytes.
A strict DER reader (X.690) walks the bytes and the page decodes the certificate fields defined in RFC 5280, or the request fields in RFC 2986. Anything malformed is reported with its byte position.
Fingerprints are hashes your browser works out with its built-in Web Crypto. With several certificates, the page puts them in order and checks each signature with the issuer's public key, also with Web Crypto.
Nothing is sent to abbott.cloud or anywhere else, so the request log below stays empty.

What's kept: nothing. What you paste isn't added to this page's address, so it stays out of your browser history. A link to this page that ends in #q= followed by a certificate opens it once, then clears it from the address. Browsers never send the part after # to a website. Older links with ?q= still work, but your browser sends that part of the address to abbott.cloud when it opens the page.

Limitations:

It doesn't check revocation (OCSP or CRLs), or whether your devices trust a root. That depends on each device's trust store.
Name constraints and policies are shown but not enforced along the chain.
Browsers can't check DSA, MD5, SHA-224 or post-quantum (ML-DSA) signatures, and most can't check Ed448.
Private keys are recognised but never decoded or shown.

Code: cert.js (this page), x509.js (certificates, requests, chains and signatures), asn1.js (DER reader), cert-examples.js (the examples).