How to use
Paste PEM (-----BEGIN ... -----), Base64 or hex text into the input. For a DER file (.der, .cer, .crt, .p7b and so on), choose it or drop it.
On each line of the tree, check the offset, the tag (class, constructed or primitive, number), the length and the value. Known OIDs show their names.
Under “Points to watch”, check wrong lengths, trailing bytes and non-DER encodings such as an unnecessary leading 0 in an INTEGER.
If a private key is included, the values are hidden and a warning appears. They are shown only when you press “Show values”.
Use “Copy result” or “Save as text” to take the tree out as plain text.
What it does
Reads tags and lengths one by one
Reads the tag class, constructed or primitive, and number (including multi-byte high numbers), and the short, long and indefinite (BER) length forms. Each item is shown in the tree with its offset.
Reads values by type
INTEGER in hex and decimal (up to 512 bytes), OIDs in dotted form with a name (about 60 common ones), BIT STRING with its unused-bit count, and UTCTime and GeneralizedTime converted to ISO form.
Opens nested DER
An OCTET STRING or BIT STRING whose content reads cleanly to the end as DER (SEQUENCE or SET) is opened as nested. Otherwise the raw value is shown.
Flags DER rule violations
Notes lengths beyond the data, trailing bytes, an unnecessary leading 0 in an INTEGER, a length that is not in its shortest form, and a BOOLEAN that is neither 00 nor FF.
Hides private-key values
When the structure of a PKCS#8, RSAPrivateKey, ECPrivateKey or encrypted private key is found, INTEGER and OCTET STRING values are hidden by default. They appear only when you press the button, and nothing is saved.
Use cases
- See what is inside a certificate or key file as DER structure, without any field interpretation
- Find out what an OID (signature algorithm, curve or extension) refers to
- Check that DER is written correctly, such as no unnecessary leading 0 and a minimal length form
- You opened a key file by mistake and want to see its structure without looking at the values
Supported formats
Input
Output
Capability matrix
| Feature | Support | Notes |
|---|---|---|
| Show DER and BER TLV as a tree (tag, length, value, offset) | Supported | — |
| Names for OIDs | Partial | Only about 60 common ones. Other OIDs are shown as numbers |
| Listing certificate or CSR fields with their meaning | Not supported | Only OID names are shown. For expiry or SAN lists, use Certificate, CSR & PEM Studio |
| Flagging invalid encodings (DER rules) | Partial | Only the common violations are flagged. Not every violation is covered |
| Showing private-key values, or decrypting with a passphrase | Not supported | Private-key values are hidden by default. Nothing is decrypted |
| Verifying signatures or certificate chains | Not supported | Only the structure is read. Signatures and trust are not checked |
| Contents of PKCS#12 (.p12 / .pfx) | Not supported | They are encrypted with a password, so they are not read |
| Converting to DER and saving | Not supported | The tool only reads and displays. It does not create converted files |
| Sending anything to a server | Not supported | Input is processed only on your device and is never sent |
Limits & notes
- Up to 5 MB of input (up to 12 million characters of hex or Base64 text). Up to 100 PEM blocks.
- Reads up to 20,000 nodes and nesting depth 64. Anything beyond these limits is not read, and a note is shown.
- Hex display shows the first 32 bytes of each value. Decimal display of an INTEGER is limited to 512 bytes.
- Hex and Base64 are told apart by the characters. Text made only of hex characters with an even length is read as hex.
- Private-key values (INTEGER and OCTET STRING) are not shown. Press “Show values” to see them.
Privacy & safety
What you paste and the files you open are parsed entirely in your browser. The input, file names and results are never sent to or stored on a server. Private-key values are hidden by default and are never saved.
FAQ
How do I decode ASN.1?
What is the difference between DER and BER?
How do I see a certificate’s expiry date or SANs by field?
What happens if I paste a private key PEM?
What is shown for an OID that is not in the list?
Can it read SSH public keys (ssh-ed25519 and so on)?
Related tools
Certificate, CSR & PEM Studio
Reads PEM, DER (.cer/.crt), CSR and PKCS#7 (.p7b) and lists the subject, expiry (days left), SANs, public key, signature algorithm and SHA-256 fingerprint. It also checks chain order and signatures and converts PEM and DER. Everything runs in your browser and private keys are never read.
Binary Data Studio (Hex Viewer)
Drop a file to open it as a hex dump with offsets, hex bytes and a text column. Only the visible rows are read, so even multi-gigabyte files open without freezing, and nothing leaves your device. Search, value interpretation, compare and export are on the same screen.
Encode / Decode Studio — Base64, URL, JWT & more
Paste %E3%81%82, an eyJ… token or any encoded string — the format is detected and decoded instantly. Errors say exactly which character is wrong and why, and nothing leaves your browser.
TOTP Studio (2FA Code Checker)
For developers testing two-factor authentication: compute TOTP and HOTP codes from a secret, and build or read otpauth:// URIs and QR codes. Everything runs with Web Crypto in your browser; the secret is never sent or stored.
SSH Key Studio
Paste an ssh-ed25519, ssh-rsa or ecdsa-sha2-nistp256 public key, or lines from authorized_keys or known_hosts. The type, bits and fingerprints appear (SHA256 in the same form as ssh-keygen -lf, MD5 colon-separated). Private-key contents are never shown; you are warned to paste public keys only.
Crypto Studio — Hash, HMAC, Encryption & Keys
Type text and see 12 hashes — SHA-256, SHA-3, BLAKE3 and more — at once. Verify webhook HMAC signatures, encrypt text with a password, generate key pairs and create or check bcrypt hashes, all on your own device with nothing uploaded.
Last updated: