CSR and certificate decoder
/tools/csr-decoder
Paste a certificate or a signing request and read every field, decoded in this browser with the raw ASN.1 underneath. A request's self-signature is verified here; each field carries a caption saying who wrote it and what that does and does not prove.
Slightly malformed documents decode too, with the defect named next to the field it concerns: the warnings are the diagnosis.
Paste PEM, bare Base64, or hex; or open a .pem, .csr, .crt, .cer or .der file. The document type is detected automatically. Nothing you paste leaves this browser.
Decoded
This client tool does not transmit or store what you paste. Decoding happens in this browser.
Raw ASN.1 tree
What this tool checks, and what it cannot
A signing request's self-signature is verified here, in this browser, because everything needed is inside the request. A certificate's signature is not verified: that requires the issuer's certificate, and this tool fetches nothing. The validity window is shown next to today's date, and the reading is yours; this page renders no verdict.
Fields written by a requester are labelled as written, not as verified. Nothing in a signing request proves identity; the issuing CA decides what ends up on a certificate.
The privacy claim is checkable
Open the network panel before you paste, and watch: from the first character, this page sends nothing. Documents pasted here often carry internal hostnames; they stay in this browser, are not stored anywhere, and disappear with the page.
There is no private key on this page. A signing request and a certificate are both public halves; if you have been asked to paste a private key into any web tool, decline.
Need the matching generator?
The CSR generator creates a request and key in this same browser, and its output screen can hand a request straight to this decoder without the request touching a URL or any storage.
Running this tool offline
A self-contained offline copy is published as a single HTML file: download the offline copy, version 1.0.1. It bundles the same decoder with no network dependency and no service worker, and runs from a local file in a current browser.
Its SHA-256 digest is published in the release manifest in the systrex source repository, deliberately not on this page: a page cannot vouch for itself. Verify a copy against the manifest before trusting one you did not download here.