Certificate & CSR Decoder

Read a PEM certificate or CSR in this browser. See the subject, SANs, dates, public key, and fingerprints. Private keys are refused.

Loading Tool Editor...

What This Tool Reads

Paste a PEM certificate or certificate signing request, or open a .pem, .crt, .cer, .csr, or .p7c file. A PEM chain and a PKCS#7 bundle are listed one certificate at a time.

Each block shows the subject, issuer, serial, validity dates, public key, signature algorithm, subject alternative names, key usage, basic constraints, and SHA-1 and SHA-256 fingerprints.

What It Does Not Do

It does not connect to a host, look up a live certificate, or decide whether a certificate authority trusts the signature. Private keys and PFX / PKCS#12 files are refused.

Decoding stays in this browser tab. LeetTools does not receive the certificate or CSR.

Certificates And CSRs

What is the difference?

A certificate is already issued. It has an issuer, a serial number, and validity dates. A CSR is the request you send to a certificate authority. It has the subject and public key, but no issuer and no expiry.

Which PEM labels work?

Use CERTIFICATE, CERTIFICATE REQUEST, or PKCS7. X509 CERTIFICATE, TRUSTED CERTIFICATE, and NEW CERTIFICATE REQUEST are accepted too. Open also reads DER certificates and DER PKCS#7 files such as .p7c.

Does this check trust?

No. The page reads the fields stored in the file. It does not verify the signature, build a chain to a public CA, or contact the hostname in the certificate.

Privacy And Limits

Is my certificate uploaded?

No. You paste the PEM or use Open to read a file in this tab. LeetTools does not receive it.

Can I paste a private key?

No. A PRIVATE KEY block is refused. To compare a key with a certificate on your own machine, use OpenSSL: openssl pkey -in key.pem -pubout and openssl x509 -in cert.pem -pubkey -noout.

Why might a file fail?

PFX / PKCS#12 files are not decoded here, because they can contain a private key. Files larger than 1 MB are refused. A certificate that OpenSSL can print with openssl x509 -in cert.pem -noout -text, or a PKCS#7 file that openssl pkcs7 -print_certs can print, should decode.