X.509 certificate decoder (PEM, browser-local)
Parses a single PEM X.509 certificate in your browser and prints the decoded fields, the date check, key identifiers and the SHA-256 fingerprint.
Free tool: results are indicative and are not a certification. Use is subject to the Terms of service and the Privacy policy.
What PARSED means here
The fields are decoded and the date window is checked. The signature, the trust path, revocation and any device profile are not verified. A certificate that decodes is not a certificate that can be trusted.
Paste one PEM certificate
Paste a PEM certificate from your release toolchain. Nothing is transmitted: the DER parser runs in this tab. Limit: 32 KiB · one certificate · private keys are rejected.
Limits you should know
- 32 KiB maximum input
- One certificate per run
- Private keys are rejected
- PEM only — DER must be converted first
What this result does not prove
PARSED means decoded. The validity check compares dates only. Chain trust, signatures, revocation and device profiles are NOT verified.
What is the X.509 Decoder?
An X.509 decoder turns the base64 PEM block into the fields it contains: subject, issuer, serial number, validity window, public-key information, key usage and fingerprints. This is useful when a release or supplier bundle includes a certificate and you need to know what it claims before deciding whether to trust it.
Decoding is not verification. The tool can tell you that a certificate says it is valid until a date and was issued by a named CA. It cannot tell you whether the signature is valid, whether the chain reaches a trusted root, whether the certificate was revoked, or whether the key belongs to the device in front of you.
Supported formats and limits
| Accepted input | One PEM X.509 certificate (`-----BEGIN CERTIFICATE-----`) |
|---|---|
| Enforced limits | 32 KiB maximum input · One certificate per run · Private keys are rejected · PEM only — DER must be converted first |
| Processing | Decoded locally with a bounded DER parser. The certificate is never uploaded, and results are discarded when you leave the page. |
| Not included | PARSED means decoded. The validity check compares dates only. Chain trust, signatures, revocation and device profiles are NOT verified. |
How it works
- Read the PEM block locally. The pasted or selected PEM is decoded to DER bytes in the browser. Private-key blocks are rejected before parsing.
- Parse with a bounded reader. A small DER reader enforces definite lengths, bounds checks and a node budget. Trailing data and unsupported structures are reported as errors.
- Print the fields. Subject, issuer, serial, validity window, key identifiers, key usage and SHA-256 fingerprint are shown with the raw values.
- Check the dates only. The validity status compares “not before” and “not after” with the current time. It does not verify signatures, chains or revocation.
What it checks
- PEM decoding and DER structure
- Subject and issuer distinguished names
- Serial number and validity window
- Public-key algorithm and key identifiers
- Key usage and extended key usage, when present
- Subject alternative names, when present
- SHA-256 fingerprint of the DER certificate
- Date validity — and explicitly nothing about trust
Common errors and fixes
The input is rejected because it is DER, not PEM.
Convert the DER file to PEM first, for example with `openssl x509 -inform DER -in cert.der -out cert.pem`. This tool accepts the PEM block only.
A private key is rejected.
That is deliberate. Never paste a private key into a website. This tool only accepts a public certificate.
A bundle with several certificates fails.
The tool decodes one certificate per run. Split the bundle and decode the certificate you need.
The dates are valid but the certificate should not be trusted.
Date validity is not trust. Check the issuer, the chain, the revocation status and the key's intended use through your normal PKI process. This tool does not do that for you.
Example output
The result is a report, not a score. This is the shape of the output you can export; the example reports show the full engine output for a synthetic firmware SBOM.
Parse: PARSED (not verified)
Subject: CN, organisation and country as encoded
Issuer: the CA distinguished name
Validity: not before / not after, with a date check
Fingerprint: SHA-256 of the DER certificate
Trust: NOT_VERIFIED — no signature, chain or revocation checkPrivacy and data handling
The certificate is decoded in this browser tab with a local parser. It is never uploaded. Results disappear when you leave the page; the JSON export is generated locally.
Frequently asked questions
Does this tool verify the certificate?
No. It decodes the fields and compares the validity dates. Signatures, trust chains, revocation and device identity are not verified, and the result says so.
Can I decode a certificate chain or a private key?
No. One public certificate per run. Private keys are rejected, and a multi-certificate bundle must be split.
Why is PEM required?
The parser reads the base64 PEM envelope directly. DER input must be converted to PEM first; the error message includes the OpenSSL command.
Is the certificate uploaded?
No. The site is static and the parser runs in the browser. Nothing is stored or transmitted.
Related resources
Where this fits in the product workflow
The free tools answer one question at a time. EmbedHarbor is building the connected workflow around them — product versions, supplier components and release evidence. Product-version storage and monitoring are Early Access, not generally available.