# X.509 Certificate Decoder

URL: https://phishdestroy.io/developer-tools/x509-decoder
Category: Files & pages
Where it runs: Runs locally (nothing you enter is uploaded)

Paste a PEM certificate or chain, or drop a .crt, .cer, .der or .p7b file, to see every name it covers, who issued it, how long it is valid and its fingerprints, with crt.sh links for each name.

## Example input

Test certificate for example.com

```
-----BEGIN CERTIFICATE-----
MIIEujCCBD+gAwIBAgIJASNFZ4mrze8BMAoGCCqGSM49BAMCMEIxCzAJBgNVBAYT
AlVTMRQwEgYDVQQKDAtFeGFtcGxlIE9yZzEdMBsGA1UEAwwURXhhbXBsZSBUZXN0
IFJvb3QgQ0EwHhcNMjYwMTAxMDAwMDAwWhcNMjYwNDAxMDAwMDAwWjCB4jETMBEG
CysGAQQBgjc8AgEDEwJVUzEdMBsGA1UEDwwUUHJpdmF0ZSBPcmdhbml6YXRpb24x
DjAMBgNVBAUTBTEyMzQ1MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5p
YTEVMBMGA1UEBwwMRXhhbXBsZSBDaXR5MRQwEgYDVQQKDAtFeGFtcGxlIE9yZzEQ
MA4GA1UECwwHVGVzdGluZzEUMBIGA1UEAwwLZXhhbXBsZS5jb20xJTAjBgkqhkiG
9w0BCQEWFmhvc3RtYXN0ZXJAZXhhbXBsZS5jb20wWTATBgcqhkjOPQIBBggqhkjO
PQMBBwNCAAQKRzEIgSE3KuPFFfnBW/e1rv/eBMvB9UcJV2IzmnCmeL1OQ2bZMgys
Uw5kZkK0MML16Q7waZrihdHZJTHFPXCfo4ICezCCAncwDAYDVR0TAQH/BAIwADAO
BgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0G
A1UdDgQWBBRYpSZy3JLND2TiEQEyO23ty3tawjAfBgNVHSMEGDAWgBQgtQyBIetb
dU1WSz0o2wT+FYlkVjCBlQYDVR0RBIGNMIGKggtleGFtcGxlLmNvbYINKi5leGFt
cGxlLmNvbYIPd3d3LmV4YW1wbGUubmV0ghFsb2dpbi5leGFtcGxlLm9yZ4cEwAAC
CocQIAENuAAAAAAAAAAAAAAAAYEWaG9zdG1hc3RlckBleGFtcGxlLmNvbYYYaHR0
cHM6Ly9leGFtcGxlLmNvbS9jZXJ0MDMGA1UdHwQsMCowKKAmoCSGImh0dHA6Ly9j
cmwuZXhhbXBsZS5jb20vdGVzdC1jYS5jcmwwYgYIKwYBBQUHAQEEVjBUMCMGCCsG
AQUFBzABhhdodHRwOi8vb2NzcC5leGFtcGxlLmNvbTAtBggrBgEFBQcwAoYhaHR0
cDovL2NhLmV4YW1wbGUuY29tL3Rlc3QtY2EuY3J0MEkGA1UdIARCMEAwCAYGZ4EM
AQIBMDQGCysGAQQBgt8TAQEBMCUwIwYIKwYBBQUHAgEWF2h0dHA6Ly9jcHMuZXhh
bXBsZS5jb20vMHwGCisGAQQB1nkCBAIEbgRsAGoAMwARERERERERERERERERERER
EREREREREREREREREREREQAAAZt22qgAAAAEAwAEAQIDBAAzACIiIiIiIiIiIiIi
IiIiIiIiIiIiIiIiIiIiIiIiIiIiAAABm3baq+gAAAQDAAQBAgMEMAoGCCqGSM49
BAMCA2kAMGYCMQCVPfxWDN1hJmIcriOW5n7OvtId8An+59spRf24F0C+4dvRYqcy
kXB/QBoZX8Q70OkCMQCi76K7RJ0TRsZVIojXtA5/nrV4ndDx3KcQ936ya2QsGUny
hokNkWGVbyoShu/7tJc=
-----END CERTIFICATE-----

```

Generated with OpenSSL for this page: eight SAN entries including *.example.com, www.example.net and 192.0.2.10, a DV policy, two embedded SCTs and the issuer Example Test Root CA. It was valid from 1 January to 1 April 2026, so it is shown as expired.

## FAQ

### What does the decoder read from a certificate?

It parses the DER structure strictly and shows the version, serial number, signature algorithm, subject and issuer attributes, validity, public key type and size, and the extensions: SAN names, key usages, policies (DV, OV, EV), CRL and OCSP addresses and embedded CT timestamps. SHA-1, SHA-256 and public-key fingerprints are computed with Web Crypto.

### Does it check that the certificate is trusted or revoked?

No. It does not verify signatures, build a path to a trusted root or query OCSP and CRLs; it only compares issuer and subject names and key identifiers to tell whether a chain is in order. Flags such as a free DV issuer or a wildcard name are context for an investigation, not a verdict.

### Is the certificate sent anywhere?

No. Decoding and fingerprinting run in your browser. The crt.sh buttons are links that open crt.sh in a new tab with the fingerprint or name in the address, and only when you click them.

## Related tools

- [Favicon Hash (mmh3)](https://phishdestroy.io/developer-tools/favicon-hash)
- [File Type Sniffer](https://phishdestroy.io/developer-tools/file-type-sniffer)
- [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker)
- [Lookalike Domain Generator](https://phishdestroy.io/developer-tools/lookalike-generator)
- [DNS over HTTPS Lookup](https://phishdestroy.io/developer-tools/dns-over-https-lookup)

All tools: https://phishdestroy.io/developer-tools