SSL/TLS Certificate Decoder

An X.509 certificate is encoded in ASN.1 DER — a compact, self-describing binary format that predates JSON or XML by decades but works on the same basic principle: every value is tagged with its type and length before its content. Reading one by hand means walking that tag-length-value structure recursively, which is exactly what this tool's parser does, decoding SEQUENCE, SET, INTEGER, OBJECT IDENTIFIER, BIT STRING, and time types directly from the raw bytes.

Rather than treating certificate decoding as a black box, this was built and verified from first principles: a self-signed test certificate was generated with OpenSSL, and this parser's output — subject, issuer, serial number, validity dates, RSA key size, and Subject Alternative Names — was checked field-by-field against Node.js's built-in crypto.X509Certificate parser, the same certificate-parsing engine Node uses internally. Separate EC (P-256) and expired-certificate test cases were checked the same way, confirming both key types and expiry detection work correctly.

It reads both RSA and EC (elliptic curve) public keys, correctly computing RSA modulus bit-length and identifying named EC curves like P-256, and decodes the extensions block, including a proper GeneralNames parser for Subject Alternative Names (covering DNS names, IP addresses, email addresses, and URIs), Basic Constraints, and Key Usage flags.

This tool intentionally stays in its lane: it decodes the certificate's own structure and dates, but doesn't check revocation status (CRL/OCSP) or validate the signature against a trusted root certificate authority, both of which require network access this tool deliberately doesn't use. Everything it does show, it computes entirely from the bytes you paste in, locally in your browser.