PEM Decoder

The PEM stays in your browser. This tool does not scan hosts. Analytics and ads may load on the page.

PEM

Paste one or more PEM blocks. Private key bytes are not printed.

How to decode a PEM

Paste PEM

Include the BEGIN and END lines.
Decode

Read type, subject, SAN, and dates when the parser can extract them.
Read keys with care

For PRIVATE KEY blocks, only type, length, and algorithm appear.
Use the sample

Load sample produces a local certificate with CN=localhost.

Common Use Cases

Certificate Identity Review

Read a certificate subject, issuer, serial number, validity dates, and subject alternative names.

Certificate Bundle Inspection

Split several PEM blocks and inspect the type and DER length of each block.

CSR Subject Check

Read the subject and public-key algorithm from a supported certificate signing request.

Key Container Identification

Identify a PEM key container and show its length without printing the decoded key bytes.

Why decode PEM in the browser

A PEM block is base64 DER between BEGIN and END labels. This page splits those blocks, measures DER length, and walks X.509 enough to show subject, issuer, dates, and SAN when the structure is a certificate. Private key material is not printed. The PEM is not uploaded to FindUtils. Analytics or ads on the page may still load.

FindUtils PEM Decoder splits one or more BEGIN and END blocks and decodes their base64 content into DER bytes. It shows the block type and byte length for every recognized block.

For supported X.509 certificates, it can show the subject, issuer, serial number, validity dates, signature algorithm, public-key algorithm, and subject alternative names. CSR and key containers provide a smaller set of structural details.

Decoding runs in your browser, and private key bytes are not printed. Use the SSL Certificate Checker for a live host, or use the HMAC Generator for controlled message-signature tests.

How it compares

A live SSL checker connects to a host and examines the certificate it serves. FindUtils PEM Decoder examines only the text you paste, which is useful for local files but cannot prove deployment state, trust, revocation, or hostname validity.

A successful parse also does not prove that a key and certificate match. Use the JWT Decoder for JSON Web Token structure instead of PEM data.

PEM Inspection Tips

Keep the BEGIN and END labels unchanged and make sure each pair uses the same block type.
Compare certificate dates with the current time yourself because the tool does not give an expiry verdict.
Do not use structure output as proof that a certificate signature or chain is valid.
Keep private keys out of shared screenshots even though decoded key bytes are not printed.
Use a live SSL checker when you need to inspect the certificate that a host currently serves.

Frequently Asked Questions

Does this contact a CA?

No. FindUtils decodes the pasted PEM in your browser and does not contact a certificate authority. Analytics and ads may still load on the page.

Can it decode a private key?

FindUtils shows the PEM type, DER length, and an algorithm when the parser can identify it. It does not print decoded private-key bytes or upload the PEM input.

Is this a live SSL check?

No. PEM Decoder examines only the text you paste. Use the SSL Certificate Checker when you need the certificate currently served by a public host.

What if subject is missing?

Some PEM blocks show only type and DER length when the limited ASN.1 reader cannot extract names. This does not prove that the block is invalid.

Does it verify the chain?

No. It inspects the structure of the pasted block. It does not verify signatures, trust anchors, intermediates, revocation, or hostname rules.

Can I paste more than one PEM block?

Yes. The decoder separates matching BEGIN and END blocks. It reports each recognized block in source order.

Does it tell me whether a certificate is expired?

It shows the not-before and not-after dates when it can read them. It does not compare those dates with the current time or make a trust decision.

Can it show subject alternative names from a CSR?

No. CSR inspection is limited to the subject and public-key algorithm. Subject alternative names are shown only for supported X.509 certificate blocks.

Can it decrypt an encrypted private key?

No. It can identify an ENCRYPTED PRIVATE KEY block and show structural details. It does not request a password or decrypt the key.

Does a decoded certificate mean it is valid?

No. Successful parsing only means the limited reader found supported structure. It does not verify the signature, trust chain, hostname, revocation state, or key match.

Run it from code

$ curl -X POST \
  api.findutils.com/api/tools/pem-decoder/execute \
  -d '{"pem":"-----BEGIN CERTIFICATE-----\nMIIB\n-----END CERTIFICATE-----"}'

$ claude mcp add findutils \
  --transport http https://mcp.findutils.com/
# then call findutils:pem_decoder

API reference Add to Claude