Certificates & keys

Decode certificates, signing requests, revocation lists, OCSP answers and Certificate Transparency timestamps; generate a CSR and its key, check that a key, certificate and CSR belong together, compare two certificates, put a chain in order and fetch missing intermediates, compute SPKI pins and test keys for known weaknesses; open PFX files, split PEM bundles, explore raw ASN.1 and build the openssl command you need. Keys stay in your browser; the few checks that need our server say what they send before they send it.

17 tools

X.509 Certificate Decoder

Inspect certificates

Decode a PEM or DER certificate: subject, issuer, validity, key algorithm and curve, signature algorithm, extensions — with notes on deprecated algorithms and post-quantum readiness.

SSH Key Inspector

Decode authorized_keys entries

Paste an OpenSSH public key or a whole authorized_keys file: key type, curve or size, SHA-256 and MD5 fingerprints, comments — with an assessment of deprecated key types.

OpenSSL Command Builder

Build the openssl command you need

Pick a task — EC or RSA keys, self-signed certificates, CSRs, PKCS#12 bundles, signatures, TLS probes — fill in the blanks and copy a command that works, with every flag explained. Paste a command you found somewhere and it explains that too.

ASN.1 Explorer

Decode any DER or BER structure

Paste PEM, base64 or hex, or drop a DER file, and walk its ASN.1 tree with byte offsets, OID names and highlighted hex. Flags every place that is BER but not DER.

DER Text Editor

Edit DER as readable text

Convert any DER or BER structure into the DER ASCII text format, edit it like code, and compile it back to exact bytes. Ideal for building test vectors and deliberately malformed inputs.

CSR Decoder

Check a CSR before the CA does

Paste or drop a certificate signing request to see its subject, SANs, key, requested extensions and attributes, verify its self-signature, and catch the mistakes CAs reject.

CRL Decoder

Read a CRL and find a serial

Drop a .crl file or paste PEM to see who issued it, how fresh it is and every revoked certificate with its reason — then check its signature and whether your certificate is listed.

OCSP Decoder

Read OCSP answers, build requests

Paste an OCSP response to see whether a certificate is good or revoked, how fresh the answer is and who signed it — or build the OCSP request for a certificate, ready for curl or OpenSSL.

SCT Decoder

Which CT logs saw a certificate

Paste a certificate to see its embedded Signed Certificate Timestamps: the CT logs that recorded it, when, their status in Chrome and Apple, each log’s signature and whether the CT policy is met.

PFX Inspector

Look inside a .pfx or .p12 file

Drop a .pfx or .p12 file and enter its password: see every certificate and private key, whether they belong together, how strongly each is encrypted, and export them as PEM — all in your browser.

PEM Bundle Splitter

Split a PEM file into clean parts

Paste a PEM bundle — a server chain, a CA store, OpenSSL output with Bag Attributes — and get every block identified, the chain in server order, fingerprints, and clean files to download.

CSR Generator

Create a CSR and its key locally

Create a PKCS #10 certificate signing request with a key generated in your browser or with your own key. Get the PEM files and the equivalent openssl req command — the private key never leaves the page.

Key & Certificate Matcher

Does this key fit this certificate?

Paste a private key, certificates, CSRs and public keys and see which of them share a key pair, with the SPKI SHA-256 of each. A private key is reduced to its public half in your browser.

Certificate Diff

What changed between two certificates

Paste an old and a new certificate to see every difference: names added or dropped, a new key, another issuer, changed usages, revocation URLs and extensions. Tells a renewal from a re-issue or a cross-sign.

SPKI Pin Generator

Public-key pins for mobile apps

Compute the SHA-256 SPKI pin of every certificate in a chain, or of a CSR or key, and get ready-to-paste configuration for Android, TrustKit (iOS) and OkHttp — with checks for backup pins and expiry.

Weak Key Checker

Find broken and leaked keys

Test RSA, EC and other public keys for known generation flaws — ROCA, close primes, small factors, a tiny private exponent — in your browser, and against the badkeys lists of Debian weak keys and published private keys on request.

Certificate Chain Builder

Order and fix a certificate chain

Paste a certificate bundle in any order: it is sorted from leaf to root with every signature verified, missing intermediates are found and fetched through AIA, and you get the exact chain your server should send.