Certificate tools that run in your browser

Every tool below parses your input locally with JavaScript. Nothing is uploaded, logged or stored, and each tool page ships a Content Security Policy with connect-src 'none' so your browser blocks outbound requests outright rather than taking our word for it.

There is also an MCP server, which gives an AI agent the same decoders plus the reference itself. It parses at the edge rather than in your browser, so it is the right choice for an agent and the wrong one for a private key.

• CSR decoder

  Paste a certificate signing request to see its subject, SANs, key type and signature algorithm.

  Open tool →

• Certificate decoder

  Full X.509 breakdown: validity dates, issuer, SANs, extensions and fingerprints.

  Open tool →

• Key / certificate matcher

  Check whether a private key actually belongs to a certificate or CSR, before a deploy fails.

  Open tool →

• PEM / DER converter

  Convert a certificate between Base64 PEM text and binary DER, and download the result.

  Open tool →

• Chain checker

  Paste a bundle to check the order, spot a missing intermediate, and find expired links.

  Open tool →

How to check that claim yourself

1. Open any tool page below.
2. Open your browser's developer tools and switch to the Network tab.
3. Paste a certificate and run the tool.
4. No request appears. Then open the console and try fetch('https://example.com') — the CSP blocks it.

The equivalent command-line checks are documented throughout the OpenSSL section if you would rather not paste anything into a browser at all, which is a perfectly reasonable position to hold about a private key.