📜 X.509 / CSR Decoder

Decode a certificate or signing request.

Certificate or CSR (PEM, or DER as hex/base64). Paste a whole chain to check each signature against the next certificate. Issuer certificate (optional, to verify the signature)

Notes

Everything is decoded locally; nothing is fetched (no revocation or CT checks). Fingerprints are over the whole DER encoding, the same values browsers and openssl x509 -fingerprint show. Signatures are verified with WebCrypto (RSA PKCS#1 v1.5, ECDSA P-256/P-384) or noble (Ed25519, secp256k1). RSA-PSS signatures are shown but not verified.