Compute a site's mmh3 favicon hash with ready Shodan, FOFA, ZoomEye and Censys queries.
New
X.509 Certificate Decoder
Runs locallyNew
Use X.509 Certificate Decoder
What it does
Paste a PEM certificate or chain, or drop a .crt, .cer, .der or .p7b file, to see every name it covers, who issued it, how long it is valid and its fingerprints, with crt.sh links for each name.
It runs entirely in your browser: nothing you enter is uploaded.
Example
Test certificate for example.com
-----BEGIN CERTIFICATE-----
MIIEujCCBD+gAwIBAgIJASNFZ4mrze8BMAoGCCqGSM49BAMCMEIxCzAJBgNVBAYT
AlVTMRQwEgYDVQQKDAtFeGFtcGxlIE9yZzEdMBsGA1UEAwwURXhhbXBsZSBUZXN0
IFJvb3QgQ0EwHhcNMjYwMTAxMDAwMDAwWhcNMjYwNDAxMDAwMDAwWjCB4jETMBEG
CysGAQQBgjc8AgEDEwJVUzEdMBsGA1UEDwwUUHJpdmF0ZSBPcmdhbml6YXRpb24x
DjAMBgNVBAUTBTEyMzQ1MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5p
YTEVMBMGA1UEBwwMRXhhbXBsZSBDaXR5MRQwEgYDVQQKDAtFeGFtcGxlIE9yZzEQ
MA4GA1UECwwHVGVzdGluZzEUMBIGA1UEAwwLZXhhbXBsZS5jb20xJTAjBgkqhkiG
9w0BCQEWFmhvc3RtYXN0ZXJAZXhhbXBsZS5jb20wWTATBgcqhkjOPQIBBggqhkjO
PQMBBwNCAAQKRzEIgSE3KuPFFfnBW/e1rv/eBMvB9UcJV2IzmnCmeL1OQ2bZMgys
Uw5kZkK0MML16Q7waZrihdHZJTHFPXCfo4ICezCCAncwDAYDVR0TAQH/BAIwADAO
BgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0G
A1UdDgQWBBRYpSZy3JLND2TiEQEyO23ty3tawjAfBgNVHSMEGDAWgBQgtQyBIetb
dU1WSz0o2wT+FYlkVjCBlQYDVR0RBIGNMIGKggtleGFtcGxlLmNvbYINKi5leGFt
cGxlLmNvbYIPd3d3LmV4YW1wbGUubmV0ghFsb2dpbi5leGFtcGxlLm9yZ4cEwAAC
CocQIAENuAAAAAAAAAAAAAAAAYEWaG9zdG1hc3RlckBleGFtcGxlLmNvbYYYaHR0
cHM6Ly9leGFtcGxlLmNvbS9jZXJ0MDMGA1UdHwQsMCowKKAmoCSGImh0dHA6Ly9j
cmwuZXhhbXBsZS5jb20vdGVzdC1jYS5jcmwwYgYIKwYBBQUHAQEEVjBUMCMGCCsG
AQUFBzABhhdodHRwOi8vb2NzcC5leGFtcGxlLmNvbTAtBggrBgEFBQcwAoYhaHR0
cDovL2NhLmV4YW1wbGUuY29tL3Rlc3QtY2EuY3J0MEkGA1UdIARCMEAwCAYGZ4EM
AQIBMDQGCysGAQQBgt8TAQEBMCUwIwYIKwYBBQUHAgEWF2h0dHA6Ly9jcHMuZXhh
bXBsZS5jb20vMHwGCisGAQQB1nkCBAIEbgRsAGoAMwARERERERERERERERERERER
EREREREREREREREREREREQAAAZt22qgAAAAEAwAEAQIDBAAzACIiIiIiIiIiIiIi
IiIiIiIiIiIiIiIiIiIiIiIiIiIiAAABm3baq+gAAAQDAAQBAgMEMAoGCCqGSM49
BAMCA2kAMGYCMQCVPfxWDN1hJmIcriOW5n7OvtId8An+59spRf24F0C+4dvRYqcy
kXB/QBoZX8Q70OkCMQCi76K7RJ0TRsZVIojXtA5/nrV4ndDx3KcQ936ya2QsGUny
hokNkWGVbyoShu/7tJc=
-----END CERTIFICATE-----
example[.]com
expired
DV: domain validated
Warning: Expired 202 days ago (2026-04-01T00:00:00Z).
Note: 1 wildcard name: *.example[.]com.
SUBJECT
emailAddress=hostmaster[@]example[.]com, CN=example[.]com, OU=Testing, O=Example Org, L=Example City, ST=California, C=US, serialNumber=12345, businessCategory=Private Organization, jurisdictionC=US
ISSUER
Example Test Root CA (Example Org)
VALID
2026-01-01 00:00:00 UTC →
2026-04-01 00:00:00 UTC
LIFETIME
90 days, expired 202 days ago
SERIAL NUMBER
01:23:45:67:89:AB:CD:EF:01
VERSION
v3
SIGNATURE ALGORITHM
ecdsa-with-SHA256
PUBLIC KEY
EC P-256 (256 bits)
CT TIMESTAMPS (SCTS)
2 SCTs, earliest 2026-01-01T00:00:00Z
Subject Alternative Names (8)
DNS
example[.]com
crt.sh ↗
DNS
*.example[.]com
crt.sh ↗
DNS
www[.]example[.]net
crt.sh ↗
DNS
login[.]example[.]org
crt.sh ↗
IP
192[.]0[.]2[.]10
crt.sh ↗
IP
2001:db8::1
crt.sh ↗
Email
hostmaster[@]example[.]com
crt.sh ↗
URI
hxxps://example[.]com/cert
Copy 4 DNS names
SUBJECT ATTRIBUTES
Common name (CN)
example[.]com
Organization (O)
Example Org
Organizational unit (OU)
Testing
Country (C)
US
State or province (ST)
California
Locality (L)
Example City
Email address (emailAddress)
hostmaster[@]example[.]com
Serial number (serialNumber)
12345
Business category (businessCategory)
Private Organization
Jurisdiction country (jurisdictionC)
US
ISSUER ATTRIBUTES
Common name (CN)
Example Test Root CA
Organization (O)
Example Org
Country (C)
US
Extensions (10)
Basic Constraints
critical
2.5.29.19
CA: no
Key Usage
critical
2.5.29.15
Digital signature
Extended Key Usage
2.5.29.37
TLS server authentication,
…Generated with OpenSSL for this page: eight SAN entries including *.example.com, www.example.net and 192.0.2.10, a DV policy, two embedded SCTs and the issuer Example Test Root CA. It was valid from 1 January to 1 April 2026, so it is shown as expired.
FAQ
What does the decoder read from a certificate?
It parses the DER structure strictly and shows the version, serial number, signature algorithm, subject and issuer attributes, validity, public key type and size, and the extensions: SAN names, key usages, policies (DV, OV, EV), CRL and OCSP addresses and embedded CT timestamps. SHA-1, SHA-256 and public-key fingerprints are computed with Web Crypto.
Does it check that the certificate is trusted or revoked?
No. It does not verify signatures, build a path to a trusted root or query OCSP and CRLs; it only compares issuer and subject names and key identifiers to tell whether a chain is in order. Flags such as a free DV issuer or a wildcard name are context for an investigation, not a verdict.
Is the certificate sent anywhere?
No. Decoding and fingerprinting run in your browser. The crt.sh buttons are links that open crt.sh in a new tab with the fingerprint or name in the address, and only when you click them.