SSL Certificate Parser
Decode a PEM certificate locally: subject, SANs, issuer, validity dates and SHA-256 fingerprint.
PEM certificate
Certificate fields
| Field | Value |
|---|
Subject alternative names (SAN)
SHA-256 fingerprint (of the DER bytes)
Parsing happens on the PEM bytes in this tab. The tool does not contact any server, does not check the trust chain, CRL or OCSP, and cannot tell whether a certificate was revoked.
How to use it
- Paste a PEM certificate into the box: the text runs from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----.
- Results update as you type, and the Parse button re-runs the same decode on demand.
- Read the fields table: subject, common name, issuer, serial number, version, signature algorithm and public key.
- Check the validity dates with the days remaining, then the SAN list, which shows every hostname the certificate covers.
- Copy the SHA-256 fingerprint to compare against another copy of the same certificate.
Common use cases
- Expiry checks - see the not-after date and the days left before a renewal deadline.
- Missing hostname triage - when a browser warns about a name mismatch, check whether the SAN list covers it.
- Fingerprint comparison - match fingerprints when you pin a certificate or audit a config file.
- Offline inventory audits - read serial numbers and issuers of exported certificates without a server round trip.
Why it stays private
The PEM text is decoded in this tab by a small parser built into the page, so no request leaves the browser. The tool never checks revocation, CRL or OCSP status, which means a revoked certificate still parses cleanly. Trust decisions belong to your browser and your CA store, not to this parser.
FAQ
Q: Does the tool tell me whether a certificate is trusted? A: No. It only reads the bytes you paste. Trust chains, revocation and hostname matching are decided by browsers and servers, not here.
Q: Why did parsing fail? A: The input must be one complete PEM certificate block in base64. A truncated export, a private key block, or a DER file without PEM markers will not parse, and the tool reports the failure instead of guessing.
Q: What does the sample button load? A: A synthetic certificate generated inside your browser. It is not signed by any real CA and exists only so you can watch the parser work without pasting private data.
Q: Which fingerprint is shown? A: The SHA-256 digest of the whole DER structure, the same value browsers show in their certificate details. SHA-1 fingerprints are treated as weak and are not displayed.
Your data stays on this device
SSL Certificate Parser runs 100% locally. Everything you paste or drop is processed by your own browser and never transmitted. Nothing is stored on our servers — close the tab and it is gone.
Nothing you type is sent to a server, logged, or used for analytics. The page works even with your network disconnected after first load.