Certificate decoder
Paste a PEM certificate and see exactly what is inside it. Free, no signup.
Decoding is a snapshot. Monitoring is continuous.
Reading a certificate file tells you what you have. WWT watches the certificate your server actually serves and warns you before it expires.
When you need this
A certificate file is base64 and unreadable by eye, so verifying one before installing it usually means a command line. This does the same job in a browser: confirm the file matches the hostname you ordered it for, that the dates are what you expect, and that the key and signature meet current requirements. It is also the quickest way to identify an unlabelled certificate file you found on a server and cannot place.
About certificate files
What is PEM?
PEM is the base64 text format certificates are usually distributed in. It starts with a BEGIN CERTIFICATE line and ends with END CERTIFICATE. If your file is binary, it is DER, and you can convert it with openssl x509 -inform der -in cert.der -out cert.pem.
Is it safe to paste a certificate here?
Yes. A certificate is public by design - every visitor to a site receives it. We decode it and discard it. Private keys are a different matter entirely: never paste one into any website, including this one.
My file has several BEGIN CERTIFICATE blocks. What are they?
That is a chain file: the server certificate followed by one or more intermediates. We decode the first block, which is the server certificate. The rest are the intermediates that link it to a trusted root.
What key size and signature should I expect?
RSA keys should be 2048 bits or more, or 256 bits and up for ECDSA. The signature should be SHA-256 or stronger. SHA-1 and MD5 signatures are no longer trusted by any current browser.