Encoding & Security
Certificate Decoder / Inspector
Inspect PEM X.509 certificates and validate supplied chain links locally.
Runs locally in your browserLoading the local workbench…
About this tool
Parse one or more PEM X.509 certificates and validate the links between certificates you supply. TLS servers normally omit the self-signed root; ByteMode reports a valid supplied chain without treating the absent trust anchor as an error. It never fetches issuers, OCSP, CRLs, AIA resources, or trust roots, and browser/OS trust is not evaluated.
Common uses
- Inspect subject, issuer, SAN, dates, and key usage
- Validate supplied leaf and intermediate signatures and CA constraints
- Distinguish a supplied root, an omitted trust anchor, an incomplete chain, and a self-signed certificate