日本語English

Certificate, CSR & PEM Studio

Reads PEM, DER (.cer/.crt), CSR and PKCS#7 (.p7b) and lists the subject, expiry (days left), SANs, public key, signature algorithm and SHA-256 fingerprint. It also checks chain order and signatures and converts PEM and DER. Everything runs in your browser and private keys are never read.

On-device・No uploadMobile friendlyWorks offlineBeta

Your files and input are processed only inside your browser on this device and are never uploaded to our servers.

Paste PEM starting with -----BEGIN CERTIFICATE----- (several blocks or a chain are fine) or Base64 without headers. Do not paste private keys. The input never leaves your device.

Drop a certificate file here

.cer .crt .der .pem .csr .p7b .p7c (up to 1 MB). .pfx / .p12 need a password and are not read.Accepts: CER / CRT / DER / PEM / CSR / REQ / P7B / P7C / TXT / PFX / P12Up to 976.6 KB per file

How to use

  1. server.crt (PEM)
    request.csr

    Open a certificate or CSR

  2. Expiry, SAN, public key

    Check the details in a table

  3. server.der
    certs.zip (one PEM each)

    Save as PEM or DER

Inspect a certificate or CSR, then convert between PEM and DER

  1. Paste a certificate or CSR in PEM form. For .cer / .crt / .der / .pem / .csr / .p7b, choose or drop the file (or press “Try a sample”).

  2. Under “Result”, check the subject, issuer, validity with days left, public key, SANs, extensions and fingerprints. Expired certificates and those expiring within 30 days stand out.

  3. If you pasted several, “Chain check” shows the order, AKI/SKI match, signatures and any missing intermediate.

  4. “Points to watch” flags RSA under 2048 bits, SHA-1 signatures, validity over 398 days and a missing SAN.

  5. Under “Convert & export”, save as PEM or DER, or save the chain re-sorted into the right order.

What it does

Reads whatever format you have

PEM (several blocks, chains), Base64 without headers, DER, CSR (PKCS#10) and PKCS#7 (.p7b/.p7c). Text mixed in, like the output of openssl x509 -text, is ignored and only the PEM parts are read.

Contents made readable

Splits DNs into CN, O, C and so on, and shows validity with days left, the public key (RSA length, EC curve), signature algorithm, SANs (DNS, IP, email), Key Usage, Extended Key Usage, Basic Constraints, AKI/SKI, OCSP / CA Issuers / CRL URLs, policies, whether an SCT is present, and SHA-1/SHA-256.

Chain order and signatures

Checks that each issuer matches the next subject, that AKI and SKI correspond, whether a root is self-signed and whether an issuer is missing from the input. Signatures are verified with Web Crypto, so only RSA (PKCS#1 v1.5 and PSS) and ECDSA are covered (Ed25519 if your browser supports it); anything the browser cannot verify is shown as “Not verified”.

Weak settings flagged

Flags RSA under 2048 bits, SHA-1/MD5 signatures, validity over 398 days (a rule of thumb for public TLS) and a missing SAN. Validity and SAN are not checked for CA certificates.

Private keys are not read or sent

If the input has a private-key PEM block, the tool warns and stops without reading it. Parsing uses a well-established ASN.1 library (@peculiar/x509) in your browser, nothing is sent, and URLs such as OCSP or CRL are never contacted.

Use cases

  • Check a certificate’s expiry and host names (SAN) before installing it on a server
  • Find out why a chain has a missing intermediate or the wrong order
  • Check that a CSR’s subject, SANs and key size are what you intended before sending it to a CA
  • Convert a .cer (DER) or .p7b to PEM, or PEM to DER
  • Split a file that holds several certificates into single files

Supported formats

Input

PEM (CERTIFICATE, CERTIFICATE REQUEST, PKCS7)DER (.cer / .crt / .der)CSR (.csr)PKCS#7 (.p7b / .p7c)Base64 (no headers)

Output

PEMDERZIP (individual PEMs)

Capability matrix

FeatureSupportNotes
Parse certificates, CSRs and PKCS#7 (subject, validity, public key, SANs, extensions, fingerprints)Supported—
Convert PEM ⇔ DER, re-sort a chain, export individual certificatesSupported—
Chain order, AKI/SKI match, self-signed roots and missing intermediatesSupported—
Signature verificationPartialOnly RSA (PKCS#1 v1.5 and PSS) and ECDSA (Ed25519 if your browser supports it). Schemes the browser cannot handle, or an issuer that is not in the input, show “Not verified”
Weak-setting warningsPartialOnly RSA under 2048, SHA-1/MD5 signatures, validity over 398 days and a missing SAN. 398 days is a public-TLS rule of thumb and may not apply to internal CAs
Showing SANsPartialDNS, IP, email, URL and so on. If a SAN uses an unusual form such as otherName it cannot be listed, and the tool says so
Connect to a server to fetch its certificateNot supportedNo network access (it would need an external connection)
Revocation checks (OCSP, CRL)Not supportedURLs are displayed but never accessed
Matching against browser/OS trust storesNot supportedA verified signature does not mean the certificate is trusted
Reading private keys or PKCS#12 (.pfx / .p12)Not supportedA detected private key is warned about without being read. .pfx files are not read

Limits & notes

  • Up to 1,000,000 characters pasted or 1 MB per file, and 100 items at once.
  • Signature verification covers RSA (PKCS#1 v1.5 and PSS) and ECDSA (Ed25519 if your browser supports it). Anything the browser cannot handle, and certificates whose issuer is not in the input, are “Not verified”.
  • Days left are computed from your device’s current time; a wrong clock gives wrong results.
  • The 398-day warning is a rule of thumb for public TLS server certificates. It does not apply to internal CAs, code signing or S/MIME.
  • The chain check only uses the certificates you provide. Trust stores and revocation status are not consulted.

Privacy & safety

Parsing and converting what you paste or open happens entirely in your browser. The input, file names and results are never sent to or stored on a server, and URLs such as OCSP or CRL are not contacted. If a private key is included, the tool stops without reading it.

FAQ

How do I check an SSL certificate’s expiry date?
Paste the certificate PEM (-----BEGIN CERTIFICATE-----) or choose a .cer / .crt file. The validity period and days left are shown, and expired certificates or those expiring within 30 days stand out. Days left use your device’s current time.
Can I see what is inside a CSR (subject, SANs)?
Yes. Paste the CSR PEM (-----BEGIN CERTIFICATE REQUEST-----) to see the subject, SANs, public key type and size and signature algorithm. The CSR’s own signature is verified too (mainly RSA and ECDSA).
How do I check that a certificate chain is in the right order?
Paste the server certificate, intermediates and root together. The tool checks that each issuer matches the next certificate’s subject, that AKI and SKI correspond and whether an intermediate is missing. If the order is wrong you can save the chain re-sorted.
Can I convert .cer or .p7b to PEM?
Yes. Open a DER .cer / .crt or a PKCS#7 .p7b and the certificates inside are shown and can be saved as PEM. You can also save a PEM as DER (.der).
What happens if I paste a private key?
If a block such as -----BEGIN PRIVATE KEY----- is present, the tool warns and does not read or analyze it. Nothing is sent anywhere, but you should not share private keys.
Can it connect to a server and check its certificate?
No. It only reads what you paste or open and makes no network requests. To check a server’s certificate, fetch the PEM with something like openssl s_client and paste it here.

Encode / Decode Studio — Base64, URL, JWT & more

Paste %E3%81%82, an eyJ… token or any encoded string — the format is detected and decoded instantly. Errors say exactly which character is wrong and why, and nothing leaves your browser.

No upload

Crypto Studio — Hash, HMAC, Encryption & Keys

Type text and see 12 hashes — SHA-256, SHA-3, BLAKE3 and more — at once. Verify webhook HMAC signatures, encrypt text with a password, generate key pairs and create or check bcrypt hashes, all on your own device with nothing uploaded.

No upload

Secret Scanner

Paste text or drop config and code files to list likely secrets with file, line and rule before you publish or share them. Values are masked by default and you can save a copy with them replaced by ***. A helper only — it cannot guarantee that nothing is missed.

No upload

UUID / ULID / NanoID / Token Generator

A UUID is ready the moment the page opens. Switch to UUID v7, ULID, NanoID or a random token, generate up to 10,000 at once and save them as .txt, .csv or .json. Paste an existing UUID or ULID to read its embedded time and version.

No upload

TOTP Studio (2FA Code Checker)

For developers testing two-factor authentication: compute TOTP and HOTP codes from a secret, and build or read otpauth:// URIs and QR codes. Everything runs with Web Crypto in your browser; the secret is never sent or stored.

No upload

Password Studio — Generator & Strength Checker

A strong 20-character password is ready when the page opens. Fine-tune symbols and excluded characters, switch to a memorable passphrase, or check a password you already use — all without sending anything off your device.

No upload

Last updated: