Security Tools › PKI & Certificates › Inspect & validate
Certificate decoder
Paste a certificate, signing request or revocation list (PEM, DER, Base64 or a .p7b bundle) and see every field explained in plain language, with warnings and fingerprints. Recognises post-quantum ML-DSA and SLH-DSA certificates.
- 3 free tools
- Nothing uploaded or stored
- X.509 · PKCS#10 · CRL
Inspect & validate
Understand what a certificate, request or revocation list says — and whether it holds together.
Certificate decoder X.509 · PEM · DER · P7B
Paste one or more certificates to see the subject, issuer, validity, SANs, key, extensions and fingerprints, with plain-language warnings. Recognises post-quantum ML-DSA and SLH-DSA certificates and checks their signatures.
OpenSSL equivalent: openssl x509 -in cert.pem -noout -text
CSR decoder PKCS#10
Check a certificate signing request before you send it to a CA: subject, requested names, key strength, and whether its signature is intact.
OpenSSL equivalent: openssl req -in request.csr -noout -text -verify
CRL checker
Open a certificate revocation list you downloaded, see whether it is fresh, verify its signature, and check whether a serial number is revoked.
Why no "fetch the CRL for me" button? Downloading arbitrary URLs from our server could be abused to probe other networks. Get the CRL URL from the certificate's "CRL Distribution Points" and download it yourself: curl -o ca.crl http://…