ToolbitSSL/TLS Certificate Decoder
Paste a PEM certificate and read what is actually inside it: who issued it, what names it covers, when it expires, and its fingerprint — without shelling out to openssl.
What the Certificate Decoder does
- Subject, issuer, serial number, and signature algorithm.
- Not-before and not-after dates with an expiry countdown.
- Subject Alternative Names listed in full.
- SHA-1 and SHA-256 fingerprints for pinning checks.
How to use it
- Copy the certificate block including the BEGIN and END lines.
- Paste it into the decoder.
- Read the parsed fields and check the expiry date.
Why it runs locally
Toolbit has no backend. The Certificate Decoder is implemented with standard browser APIs, so your input is processed in the tab and never uploaded, logged, or retained. That is what makes it safe to paste real data into — and it is also why the tool keeps working with the network disconnected, once you have installed Toolbit as an app.
Frequently asked questions
- Does it validate the certificate chain?
- It decodes and displays the certificate you paste. Chain validation against a trust store needs openssl or your browser's own verification.
- Can I paste a private key?
- Do not. This tool only needs the public certificate. Private keys should never be pasted into any web tool, including this one.
- Is the certificate uploaded?
- Local transformations process input in your browser. HTTP and WebSocket tools send user-initiated requests. Optional product analytics is off by default, excludes tool input and output, and stays off when your browser signals Do Not Track or Global Privacy Control.