SITE UNDER CONSTRUCTION. Everything here is provided AS IS, WITHOUT WARRANTIES, to the extent the law allows. It is information, not professional advice. Use at your own risk. Terms and liability limits →

eThorns ES
Menu
Buy us a coffeeEspañoleThorns 2026 · Made in Colombia
← Security & privacyES

Tool 1.10

SSL/TLS certificate decoder: read a PEM certificate

Paste a PEM certificate to read its subject, issuer, validity dates, SANs, key type and size, and its SHA-256 and SHA-1 fingerprints. Decoded in your browser.

Runs on your deviceRuns entirely in your browser: nothing you type or upload leaves your device.

An automated check; it doesn't guarantee security.

How to use it

  1. Open the certificate file (`.crt`, `.pem` or `.cer`) in a text editor and copy the whole block, including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines. The base64 text on its own works too.
  2. Paste it in the box and press Decode certificate. It is decoded in your browser; nothing is sent.
  3. Check the dates first, then the names in the Subject Alternative Names (SANs) table, the key and the fingerprints.

Checking a certificate file before it goes on a server

The usual reason to decode a certificate is to confirm you have the right file before installing it: that it's the one issued for your domain and not the intermediate certificate from the same bundle, that it covers every name you need (www, subdomains) and when it expires. A PEM file is a block of base64 text, so none of that shows by looking at it.

The decoder reads the X.509 structure (the format defined in RFC 5280) and shows the subject, the issuer, the validity dates, the public key type and size, the signature algorithm, the serial number, the SANs, and the SHA-256 and SHA-1 fingerprints. If you paste a whole chain, only the first certificate is decoded.

Reading the result: the certificate for tubanco.co

Say you paste the certificate issued for tubanco.co. At the top, in green, it says Valid (expires in 184 days), with the start and end dates below. With 30 days or fewer left the box turns amber, and it turns red once the certificate has expired. Subject shows who the certificate is for, for example C=CO, L=Bogota, O=Tu Banco S.A., CN=tubanco.co, in the order the certificate stores it. Issuer shows the certificate authority that signed it.

Public key shows RSA 2048-bit, or for an elliptic-curve key something like ECDSA P-256 (secp256r1) (256-bit). The SANs table lists every name the certificate covers, for example tubanco.co, www.tubanco.co and bancavirtual.tubanco.co. A name that isn't in that list gets a browser warning, even if it belongs to the same domain. The SHA-256 fingerprint is what you compare with the one your certificate authority or hosting panel shows, to confirm both are the same certificate.

What the decoder doesn't check

It reads the certificate you paste and nothing else. It doesn't check that a trusted authority really signed it, that it hasn't been revoked, or that your server sends it together with its intermediate certificate, and a self-signed certificate decodes as cleanly as any other. To see what browsers actually get from a live site, use the SSL certificate checker, which connects to the domain.

It also can't tell whether the certificate matches your private key. That key (the .key file) should never be pasted into a web page; the OpenSSL commands in the questions below compare the two on your own computer.

FAQ

What's the difference between PEM, DER, CRT and CER?

DER is the certificate in binary. PEM is the same bytes written as base64 text between the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines. `.crt` and `.cer` are only file extensions: the file can be PEM or DER inside. This page reads PEM text; to decode a binary DER file, convert it first with `openssl x509 -inform der -in cert.cer -out cert.pem`.

Why do browsers ignore the Common Name (CN)?

Current versions of Chrome, Firefox and Safari check the name you visit only against the Subject Alternative Names. The CN is still there for older software, but a name that appears only in the CN gets a warning. If your domain isn't in the SANs table, the certificate has to be reissued with it.

How do I check that a certificate matches my private key?

Compare their public keys on your own computer with OpenSSL: `openssl x509 -in cert.crt -noout -pubkey | openssl sha256` and `openssl pkey -in server.key -pubout | openssl sha256`. If both lines print the same hash, the certificate and the key belong together. This works for RSA and elliptic-curve keys.

What is a certificate fingerprint or thumbprint?

A hash of the whole certificate in its binary (DER) form. The decoder shows it with SHA-256 and SHA-1. Two files with the same fingerprint hold the same certificate, which makes it a quick way to confirm that the file you have is the one installed on a server or listed in a panel. Windows calls it the thumbprint and usually shows the SHA-1 one.

Is it safe to paste a production certificate here?

A certificate is public: your server sends it to every visitor. This page also decodes it in your browser without sending it anywhere. What you should never paste into any website is the private key.

  • 1.1Is it a scam?Paste a message or link you received and see its warning signs: brand look-alikes, new domains, short links, scam wording.
  • 1.2Scammed or hacked? What nowSteps for the first hours after a scam or a hack: a bad link, a shared code, a stolen WhatsApp, money sent.
  • 1.3Is this file safe?See what a file from WhatsApp or email really is and spot attachment tricks: disguised programs, macros, PDF scripts, SMS-reading apps.
  • 1.4Short link expanderSee where a short link (bit.ly, t.co, tinyurl…) really goes before you click it: every redirect, the final URL and warning signs.
  • 1.5Website security scanPassive check of a website's homepage: HTTPS redirect, TLS certificate, HSTS, CSP, clickjacking, cookie flags and security.txt, with a grade and fixes.
  • 1.6SSL certificate checkerCheck any site's SSL/TLS certificate: whether it's valid, when it expires, who issued it, which names it covers and the TLS version in use.
  • 1.7Lookalike domain detectorCheck a link or domain for look-alike tricks: letters from other alphabets, digits for letters, a hidden real domain.
  • 1.8Domain age checkerSee when a domain was registered, when it expires, its registrar and nameservers.
  • 1.9Password generatorRandom passwords (8 to 128 characters) or passphrases, made in your browser with its cryptographic generator.
  • 1.11Leaked password checkCheck if a password appears in known data breaches without sending it: with k-anonymity only 5 characters of its hash leave your device.
  • 1.12Link cleanerStrip utm_, fbclid, gclid, si and other tracking parameters from links before you share them.
  • 1.13Watermark an ID copyStamp who a copy of your ID is for, and the date, across the whole photo or PDF, then download a smaller copy with no photo data.
  • 1.14Encrypt textEncrypt and decrypt messages or notes with a password (AES-256-GCM) in your browser.

╌╌ END ╌╌