CertGuru

CSR decoder

Paste a PEM-encoded certificate signing request to see its subject, subject alternative names, public key algorithm and size, and signature algorithm. Decoding happens entirely in your browser: the request is never uploaded, and this page blocks outbound network requests with a Content Security Policy. The command-line equivalent is `openssl req -in request.csr -noout -text`.

The command-line equivalent

openssl req -in request.csr -noout -text

See view and decode a CSR for the individual field flags, and generate a CSR with SANs if this one is missing them.

Frequently asked questions

Is my CSR uploaded anywhere?
No. Parsing happens in your browser and this page ships a Content Security Policy containing connect-src 'none', so the browser blocks outbound requests. Open the Network tab and paste something to confirm it.
Why does it say my CSR has no subject alternative names?
Because it does not. Either -addext was used on an OpenSSL older than 1.1.1, or a config file referenced x509_extensions where it needed req_extensions. Extensions cannot be added to an existing CSR — regenerate it.
Does this verify the CSR signature?
It decodes and reports the structure but does not verify the self-signature. For that, run openssl req -in request.csr -noout -verify locally.
Can I decode a DER CSR?
Yes. Paste it as Base64 or as a hex dump and it will be recognised — the first byte of any DER structure is 0x30, which the tool checks for.