Certificate and SAML metadata decoder
Paste a certificate, a chain or a SAML metadata file. You get the name, the dates, the key, the usage and the fingerprints, and how many days are left. It runs in your browser: nothing is uploaded.
Decoded in your browser. Nothing you paste is sent to us or stored. Paste certificates only, never private keys.
Where to get what you paste
A website
Run this and paste what it prints:
openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509
A file
Open a .pem, .crt or .cer file with the button above. A binary (DER) file works too.
SAML metadata
Microsoft Entra ID: Enterprise applications, your app, Single sign-on, SAML Certificates, Federation Metadata XML. Okta: the app’s Sign On tab, Identity Provider metadata. AD FS: /FederationMetadata/2007-06/FederationMetadata.xml on the server.
Questions
Is what I paste uploaded anywhere?
No. The page reads the text with code that runs in your browser. There is no request to a server when you paste; you can watch the network tab of your browser to see it. This page also has no analytics script.
Does it tell me whether a certificate is trusted?
No. It shows what the certificate says about itself: names, dates, key, usage. It does not check the signature or build a chain to a trusted root. For a live site, a checker that connects to it is the right tool.
Why does it ignore my private key?
A private key is a secret, and this page has no use for one. If it is in the box, we say so and do not read it. If a key was ever shared, replace it.
What is the date in a SAML metadata file?
The signing and encryption certificates in the metadata have a validity, and when the signing certificate expires, sign-in through it stops working until both sides have the new one. That is the date worth watching.