Certificate Decoder
Decode a certificate, chain, .p7b bundle or CSR: names, expiry, key, extensions, chain order and signatures. Runs in your browser.
Certificates and certificate signing requests (CSRs) are base64 text that's impossible to read by eye. Decoding one before you install it, send it to a CA or hand it to a vendor catches the usual mistakes: a missing hostname in the Subject Alternative Names, a weak key, the wrong certificate in a bundle, a chain in the wrong order, or a certificate that's about to expire. Paste one or more PEM blocks (a full chain file works) or open a .crt, .cer, .der, .p7b or .csr file. Each signature is checked against the certificate that should have made it.
Decoded in your browser. Nothing you paste or open is sent to tclient.com, stored or logged.
The decoder and signature checks run on your device (WebAssembly and your browser's Web Crypto API). Files are read by this page, not uploaded. To confirm, open your browser's developer tools (F12), go to the Network tab and decode a certificate: no request is made. Certificates and CSRs are public by design, but never paste a private key into any website; if you do here, it isn't decoded or sent anywhere.