ByteScope

Certificate Decoder

Paste a certificate, read everything in it — and find out why the chain is broken.

Your files never leave your browser — all processing is local.

Drop .pem / .crt / .cer / .der / .csr files

parsed locally — nothing is uploaded

About this tool

Paste or drop PEM, DER, CRT or CER material — a single certificate, a whole chain, or a CSR — and every field is decoded instantly: subject and issuer DN component by component, validity with a days-remaining countdown (expired in magenta, under 30 days in orange, because expiry is what you're usually here to check), the full SAN list, key usage and extended key usage, public-key type and size, signature algorithm, serial number, and SHA-1/SHA-256 fingerprints.

Paste several certificates together and the tool sorts them into a chain, verifies each link, and diagnoses the classic server misconfiguration in one line: "missing intermediate certificate". The cert-and-key matcher takes a certificate and a private key and tells you whether they belong together — the five-second answer to the mid-outage question "is this even the right key?". Hostname checking compares a domain you enter against the SAN list, and weak signatures (SHA-1) and self-signed certificates are called out.

All parsing happens in your browser via WebCrypto — certificates, CSRs and above all private keys are never transmitted anywhere. Pasting a private key into a random website is normally a security mistake; here the architecture makes it safe, and you can pull the network cable to prove it.

Frequently asked questions

Is it safe to paste a private key here?
Yes — everything is parsed locally in your browser with the WebCrypto/ASN.1 libraries bundled into the page; there is no server call, which you can verify in the DevTools Network tab (or by going offline before pasting). That said, treat any pasted private key as sensitive: close the tab when done.
What does "missing intermediate certificate" mean?
Browsers trust root CAs, but your server certificate is usually signed by an intermediate CA. The server must send that intermediate along with its own certificate; when it doesn't, some clients fail with trust errors while others work (they cached the intermediate) — the classic "works in Chrome, fails in curl" symptom. Paste your chain here and the tool shows exactly which link is missing.
How do I check if a certificate matches its private key?
Paste both into the matcher. A certificate contains the public key; the tool derives the public key from your private key and compares them. A mismatch means this key won't work with this certificate — the fastest diagnosis for nginx's "key values mismatch" error.
Can it decode a CSR before I submit it to a CA?
Yes — paste the CSR to see the subject, requested SANs, and key details before sending it off. Catching a typo'd domain in the CSR is much cheaper than reissuing a certificate.
Which formats are accepted?
PEM (BEGIN CERTIFICATE / CERTIFICATE REQUEST / PRIVATE KEY blocks, pasted or dropped), DER binary files (.crt/.cer/.der), and multi-certificate PEM bundles. PKCS#12 (.pfx/.p12) containers aren't supported yet.