Certificate decoder and format converter
Open any certificate, read every field in plain English, follow the chain to the root, and export it in the format your server actually wants.
Runs entirely in your browser. Nothing is uploaded, logged, or stored.Drop a certificate here
or click to choose a file · several at once is fine
The file is read in this tab. It is never sent anywhere.
Formats read directly:
Conversion happens in this tab. The file is built in memory and handed straight to your downloads folder.
Output format
Include
Which certificate format do I have?
The extension on a certificate file is a hint, not a guarantee. A .cer file can hold either binary DER or Base64 text, and Windows will hand you both.
| Format | Extensions | Encoding | Can hold a private key | Usually asked for by |
|---|---|---|---|---|
| PEM | .pem .crt .cer .key | Base64 text with BEGIN and END lines | Yes, in a separate block | nginx, Apache, OpenSSL, Kubernetes, most Linux software |
| DER | .der .cer .crt | Raw binary | No | Java keytool, some hardware appliances |
| PKCS#7 | .p7b .p7c | Base64 or binary | No, certificates only | Windows, Java, Tomcat chain imports |
| PKCS#12 | .pfx .p12 | Encrypted binary | Yes, that is the point of it | Windows, IIS, Azure App Service, code signing |
| PKCS#10 | .csr .req | Base64 text | No, it carries the public key | Anything you are asking to issue a certificate |
Same conversions, in OpenSSL
Use the tool above when you want to see what you are converting. Use these when you need it in a script.
PEM to DER
Turn a Base64 text certificate into the binary form.
openssl x509 -in cert.pem -outform der -out cert.der
DER to PEM
Turn a binary .cer into something you can paste into a config file.
openssl x509 -inform der -in cert.cer -out cert.pem
PFX to PEM
Pull the certificate and chain out of a password protected .pfx.
openssl pkcs12 -in cert.pfx -nokeys -out chain.pem
PEM chain to PKCS#7
Bundle a leaf and its intermediates for a Windows or Java import.
openssl crl2pkcs7 -nocrl -certfile chain.pem -out chain.p7b
Built by the people who run certificate authorities
Most online decoders paste your certificate into a form and POST it to someone else's server. This one does not have a server to send it to.
Nothing leaves the tab
Parsing, chain building and format conversion all run in JavaScript on your machine. The only network call the page can make is the issuer fetch, and it tells you before it makes one.
Written for people who are not PKI engineers
Every field has a plain language explanation attached to it. Extended key usage stops being jargon the moment you hover it.
The whole chain, not one certificate
Bundles are split apart, the path is rebuilt from the certificates you gave it, and each link opens with the same full detail view.
Frequently asked questions
No. The file is read with the browser's FileReader API and parsed in JavaScript inside your tab. There is no upload endpoint. You can confirm it by opening your browser's network tab, or by disconnecting from the network before loading a certificate.
PEM and any Base64 text with or without BEGIN and END header lines, binary DER files whatever their extension, and PKCS#7 bundles such as .p7b and .p7c. A file holding several certificates is split apart and each one is listed separately. Password protected PKCS#12 files, .pfx and .p12, are not read yet; export the certificates with OpenSSL first.
Browsers stopped reading the common name for host matching years ago. Only the Subject Alternative Name list decides which names a certificate is valid for. A certificate whose CN is correct but whose SAN list is missing the name will fail.
Browsers cache intermediate certificates from other sites they have visited, and some will silently fetch a missing issuer. Other clients, especially Java applications, mobile apps and API callers, will not. A chain that works in your browser and fails from a server is almost always a missing intermediate.
Open the certificate above, go to the Download and convert tab, choose the output format and whether to include the intermediates and the root, then download. The equivalent OpenSSL commands are listed further up this page.
No. It reads and converts certificates and shows you the OCSP and CRL URLs the certificate publishes, but it does not contact them and it does not verify signatures. Continuous revocation and expiry monitoring is what EZMonitor does.
Stop finding expired certificates by hand
EZMonitor watches Certificate Transparency logs and your internal network, and tells you which certificates are about to break something.