X.509, decoded locally
Inspect a certificate without uploading it.
Paste a PEM certificate and read every field a developer checks: subject, issuer, validity, key type, SANs, and whether it is a CA or self-signed. It parses in your browser and nowhere else.
nothing leaves your tab. open the network tab and watch.
Try it, live in your browser
Paste a -----BEGIN CERTIFICATE----- block on the left and its fields appear here.
How it works
-
Paste
Drop in a
-----BEGIN CERTIFICATE-----PEM block. A server cert, a CA, anything X.509. -
Parse in the tab
A Rust build of the
x509-parsercrate, compiled to WebAssembly, decodes the DER right here. No request carries your certificate. -
Read the fields
Subject, issuer, validity with an expiry check, serial, signature algorithm, key type and size, SANs, and the CA and self-signed flags.
What it decodes
- SubjectWho the certificate is for. The CN and O you see in a browser lock icon.
- IssuerWho signed it. Equal to the subject when the cert is self-signed.
- ValiditynotBefore and notAfter. We flag expired and not-yet-valid against your own clock.
- SerialThe issuer's unique number for this cert, shown as colon-separated hex.
- Signature algorithmHow the issuer signed it, e.g. sha256WithRSAEncryption or ecdsa-with-SHA256.
- Public keyType and size: RSA 2048, EC P-256, Ed25519.
- Subject Alternative NamesThe DNS names, IPs, and emails the cert actually covers.
- Basic constraintsWhether this is a CA that can sign other certs.
Why Cert workbench
- Provably localThe parser is WebAssembly running in your tab. Open the network panel: pasting a cert makes zero requests.
- Correct by constructionBuilt on x509-parser, a mature pure-Rust ASN.1/DER parser, not a hand-rolled decoder.
- Reads what you checkSubject, issuer, validity, key, SANs, CA and self-signed flags, and the SHA-256 fingerprint.
- No account, no uploadA single static page. Nothing to sign up for, nothing to leak.
Part of Sealed
Sealed is a small suite of provably-local developer tools: the work happens in your browser, and the whole promise is that your data never leaves it.