# ASN.1 / DER Viewer Reads PEM, Base64, hex or a DER file and shows the ASN.1 TLV structure (tag, length, value) as a tree. Common OIDs get their names, and wrong lengths or non-DER encodings are flagged. Private-key values are hidden with a warning, and nothing is sent. - URL: https://tools.itlibra.com/en/asn1-viewer - On-device・No upload - Last updated: 2026-10-31 ## How to use 1. Paste PEM (-----BEGIN ... -----), Base64 or hex text into the input. For a DER file (.der, .cer, .crt, .p7b and so on), choose it or drop it. 2. On each line of the tree, check the offset, the tag (class, constructed or primitive, number), the length and the value. Known OIDs show their names. 3. Under “Points to watch”, check wrong lengths, trailing bytes and non-DER encodings such as an unnecessary leading 0 in an INTEGER. 4. If a private key is included, the values are hidden and a warning appears. They are shown only when you press “Show values”. 5. Use “Copy result” or “Save as text” to take the tree out as plain text. ## Use cases - See what is inside a certificate or key file as DER structure, without any field interpretation - Find out what an OID (signature algorithm, curve or extension) refers to - Check that DER is written correctly, such as no unnecessary leading 0 and a minimal length form - You opened a key file by mistake and want to see its structure without looking at the values ## What it does ### Reads tags and lengths one by one Reads the tag class, constructed or primitive, and number (including multi-byte high numbers), and the short, long and indefinite (BER) length forms. Each item is shown in the tree with its offset. ### Reads values by type INTEGER in hex and decimal (up to 512 bytes), OIDs in dotted form with a name (about 60 common ones), BIT STRING with its unused-bit count, and UTCTime and GeneralizedTime converted to ISO form. ### Opens nested DER An OCTET STRING or BIT STRING whose content reads cleanly to the end as DER (SEQUENCE or SET) is opened as nested. Otherwise the raw value is shown. ### Flags DER rule violations Notes lengths beyond the data, trailing bytes, an unnecessary leading 0 in an INTEGER, a length that is not in its shortest form, and a BOOLEAN that is neither 00 nor FF. ### Hides private-key values When the structure of a PKCS#8, RSAPrivateKey, ECPrivateKey or encrypted private key is found, INTEGER and OCTET STRING values are hidden by default. They appear only when you press the button, and nothing is saved. ## Supported formats ### Input - PEM (several blocks) - Hex (spaces and colons allowed) - Base64 - DER (.der, .cer, .crt, .p7b and so on) ### Output - Tree on screen - Text (copy or save) ## Capability matrix | Feature | Support | Notes | | --- | --- | --- | | Show DER and BER TLV as a tree (tag, length, value, offset) | Supported | — | | Names for OIDs | Partial | Only about 60 common ones. Other OIDs are shown as numbers | | Listing certificate or CSR fields with their meaning | Not supported | Only OID names are shown. For expiry or SAN lists, use Certificate, CSR & PEM Studio | | Flagging invalid encodings (DER rules) | Partial | Only the common violations are flagged. Not every violation is covered | | Showing private-key values, or decrypting with a passphrase | Not supported | Private-key values are hidden by default. Nothing is decrypted | | Verifying signatures or certificate chains | Not supported | Only the structure is read. Signatures and trust are not checked | | Contents of PKCS#12 (.p12 / .pfx) | Not supported | They are encrypted with a password, so they are not read | | Converting to DER and saving | Not supported | The tool only reads and displays. It does not create converted files | | Sending anything to a server | Not supported | Input is processed only on your device and is never sent | ## Limits & notes - Up to 5 MB of input (up to 12 million characters of hex or Base64 text). Up to 100 PEM blocks. - Reads up to 20,000 nodes and nesting depth 64. Anything beyond these limits is not read, and a note is shown. - Hex display shows the first 32 bytes of each value. Decimal display of an INTEGER is limited to 512 bytes. - Hex and Base64 are told apart by the characters. Text made only of hex characters with an even length is read as hex. - Private-key values (INTEGER and OCTET STRING) are not shown. Press “Show values” to see them. ## Privacy & safety What you paste and the files you open are parsed entirely in your browser. The input, file names and results are never sent to or stored on a server. Private-key values are hidden by default and are never saved. ## FAQ ### How do I decode ASN.1? Paste PEM (-----BEGIN ... -----), Base64 or hex text into the input, or choose a DER file. Tags, lengths and values are shown as a tree. ### What is the difference between DER and BER? BER allows the same content to be written in several ways, including indefinite lengths. DER is a subset of BER that fixes one way of writing each value (ITU-T X.690). X.509 certificates are generally encoded in DER. This tool reads both and notes any encoding that is not DER. ### How do I see a certificate’s expiry date or SANs by field? This tool is for looking at the structure itself. For the meaning of fields such as expiry, SANs and chains, use Certificate, CSR & PEM Studio. ### What happens if I paste a private key PEM? When the structure of a private key (PKCS#8, RSA, EC and so on) is found, INTEGER and OCTET STRING values are hidden and a warning says the data is processed only on your device and not sent, and that you should not share it. ### What is shown for an OID that is not in the list? No name is given. The number (for example 1.2.3.4) is shown as it is. Check the name in the documents of the organisation that registered the OID. ### Can it read SSH public keys (ssh-ed25519 and so on)? No. SSH public keys are not ASN.1. For SSH keys, use SSH Key Studio (ssh\_key\_studio).