Certificate & JWK Inspector
Inspect X.509 PEM certificates, CSRs, private-key fingerprints, and JSON Web Keys locally — without uploading. · Updated
text
json
Draft saved locally.
FAQ
Does this tool upload my private keys?
No. Parsing runs entirely in your browser. Prefer public certificates and public JWKs; never paste production private keys into any online tool.
What formats are supported?
PEM CERTIFICATE, CERTIFICATE REQUEST (CSR), PUBLIC/PRIVATE KEY blocks, and JWK or JWKS JSON documents.
Can I see Subject Alternative Names?
Yes. DNS SANs are extracted from the X.509 subjectAltName extension when present.
How are fingerprints calculated?
SHA-256 and SHA-1 over the DER bytes of the PEM payload, shown as colon-separated hex. Private keys are fingerprinted locally only.
Will malformed PEMs show helpful errors?
Yes. Invalid base64, missing BEGIN/END markers, and non-JWK JSON return plain-English errors.
Related tools
JWT Decoder
Decode JSON Web Tokens (JWT) client-side. Inspect header claims, payload data, expiration times, and token signatures.
JWE Decoder
Decrypt JSON Web Encryption (JWE) tokens with your own key, or inspect and validate them without one. Everything runs in your browser.
Base64 Encode & Decode
Encode plain text to Base64 or decode Base64 strings to UTF-8 text with URL-safe encoding and automatic JSON formatting.
Hash Generator
Generate cryptographically secure SHA-256, SHA-512, SHA-1, and MD5 message digests client-side.
RSA, ECDSA & Ed25519 Key Generator
Generate a key pair in your browser with Web Crypto and export it as PEM or JWK, with a SHA-256 fingerprint of the public key.