Decode a PEM certificate, the public ID card every website sends. It is read in your browser and sent to our server only to check revocation. Nothing is stored.
The key is checked in your browser with WebCrypto and never leaves it: nothing is sent to a server, and it is not saved.
Paste a PEM certificate or certificate request (CSR) to decode it.
SSL/TLS certificates are X.509 documents encoded in DER (binary) or PEM (Base64) format. They contain the server's public key, the identity fields (Subject), the CA that issued them (Issuer), validity dates, and Subject Alternative Names (SANs) - the list of domains the certificate covers. This decoder extracts and displays all fields from any PEM-encoded X.509 certificate.
Paste a PEM-encoded certificate (the block starting with -----BEGIN CERTIFICATE-----) into the text area. Decoding happens in your browser. To check whether the certificate has been revoked, the pasted text is then sent to VLANlab's server, which asks the issuing CA's OCSP or CRL service; when the issuer's certificate is not pasted with it, the server also downloads that from the address in the certificate. A certificate is public, but never paste a private key. You can obtain a PEM certificate from your web server config, from a CA email, or by exporting it from a keystore.
This tool parses the DER structure client-side using the Web Crypto API for fingerprints. Useful for verifying a certificate before installing it, checking expiry dates, confirming SANs during a Let's Encrypt renewal, or comparing SHA-256 fingerprints. To inspect a live domain's certificate without pasting PEM, use the SSL/TLS Checker. To decode a certificate in a chain file, paste each certificate block individually.
Decoding a certificate is not decryption. A certificate is public, and PEM is only Base64 text around its DER bytes, so any decoder can read every field. What is encrypted is the traffic of a TLS connection, and a certificate cannot decrypt it.
With modern TLS (an ECDHE key exchange, and all of TLS 1.3) not even the server's private key decrypts a recorded session. To read your own TLS traffic, let the browser or client write its session keys to a file (the SSLKEYLOGFILE environment variable) and open that file in a packet analyzer such as Wireshark.