Inspect
Generate key pair
Self-signed certificate
Sign / Verify
Do they match?
Text & documents expand_more
Numbers & maths expand_more
Data & formats expand_more
Security expand_more
Development & DevOps expand_more
Artificial Intelligence expand_more
Finance expand_more
Health & Wellness expand_more
Productivity expand_more
Games & Entertainment expand_more
Multimedia & design expand_more
Business expand_more
X.509 and TLS certificates
A toolbox for certificates and keys that runs 100% in your browser: the private key never leaves your device. Use the tabs to inspect a certificate, generate a key pair, create a self-signed certificate or sign and verify messages.
Inspect
Paste a certificate in PEM format or upload a .crt, .pem or .cer file and click Analyze. It shows the subject, issuer, validity dates with days remaining, serial number, SHA-256 fingerprint, the SPKI Pin and the subject alternative names (SANs).
Chain and CSR
If you paste several certificates (leaf, intermediates…), the chain is validated: that each one was really signed by the next (with its key, not just by name), that the names chain, that the issuer is a CA and that all are within their dates. It also tells you where it ends: whether the root is included (a server should not send it) or which root the client needs to have. There is no root store here, so it cannot say whether that root is trusted.
If you paste a CSR (BEGIN CERTIFICATE REQUEST), it is read: subject, SAN, key and whether its signature verifies —it is signed with the key it asks to certify, which proves the sender holds it—.
