CSR Decoder
Paste a PEM Certificate Signing Request to inspect its subject, public key, signature and SANs — entirely in your browser
Certificate Signing Request
Paste the PEM (-----BEGIN CERTIFICATE REQUEST-----) or raw base64 DER
Decoding happens locally. Your CSR never leaves this browser.
Decoded details
Subject, key, signature and extensions
Paste a CSR on the left — or click Load sample — to see its decoded fields here.
About this tool
A Certificate Signing Request (CSR) is the PEM-encoded PKCS#10 file you generate (with openssl req or a similar tool) and hand to a Certificate Authority when you want an SSL/TLS certificate. It binds the subject name you want on the certificate to a public key, and is signed by the matching private key. Before sending it off — or paying for a certificate — it's worth confirming exactly what's inside it.
This decoder parses the request entirely in your browser using a small, dependency-free ASN.1/DER reader. It walks the CertificationRequest structure and surfaces the version, every subject attribute (CN, O, OU, locality, state, country, email), the public key with its algorithm and size, the signature algorithm and length, the Subject Alternative Names (DNS, IP, URI, email), and any other requested extensions.
It handles both RSA keys (reporting the modulus length and exponent) and elliptic-curve keys (identifying the curve), and reads the SubjectAltName extension that modern browsers actually rely on. Nothing is uploaded — the request is processed only on your device, which makes the tool suitable for inspecting real, production CSRs.
How to use
Paste your CSR
Paste the PEM (-----BEGIN CERTIFICATE REQUEST-----) or the raw base64 DER into the left pane, or click Load sample to try one. Decoding happens instantly as you type.
Read the subject and key
Check the subject attributes match the identity you want certified, and confirm the public key is RSA 2048-bit+ or an EC P-256/P-384 key with a modern signature algorithm.
Verify the SAN list
Modern browsers validate the Subject Alternative Names, not the Common Name. Make sure every domain (and IP, if used) that should appear on the certificate is listed under SANs.
Copy the summary
Use the copy button to save a plain-text summary of the decoded fields for your records or to share with whoever issues the certificate.
Decoded fields
| Field | What it means |
|---|---|
| Version | PKCS#10 request version (normally 0, shown as version 1) |
| Subject | The name to be certified: CN, O, OU, locality, state, country, email |
| Public key | Algorithm (RSA / EC), key size or curve, modulus or public point |
| Signature algorithm | e.g. sha256WithRSAEncryption or ecdsa-with-SHA256 |
| Subject Alternative Names | DNS, IP, URI and email entries that will appear on the certificate |
| Extensions | Any other requested extensions, such as keyUsage or extKeyUsage |
Decoding is 100% client-side — the CSR never leaves your browser.
Frequently asked questions
Related tools
License Generator
Generate open-source license files — MIT, Apache 2.0, GPL 3.0, ISC, MPL 2.0, BSD-3-Clause and Unlicense — with year, holder and project filled in.
RSS Feed Generator
Build a valid RSS 2.0 feed XML from a channel title, link, description and a dynamic list of items — escape special characters and copy or download
CORS Policy Builder
Build CORS response headers, Nginx directives, and JavaScript fetch examples for safe cross-origin requests and preflight handling
HTTP Security Header Checker
Audit pasted HTTP response headers for HSTS, CSP, clickjacking, MIME sniffing, referrer, permissions, and opener protections