CSR Decoder
Decode a PKCS#10 certificate signing request to see its subject, SANs, key size, signature algorithm and fingerprints.
Parsed locally in your browser — never uploaded. Never paste a private key anywhere.
Paste a certificate signing request above — it is decoded as you type.
Summary
Subject (distinguished name)
Subject Alternative Names
Requested extensions & attributes
Checks
Public key
How it works
A certificate signing request is a PKCS#10 structure (RFC 2986): a
CertificationRequestInfo holding the version, the subject distinguished name,
the subject public key and any requested attributes, followed by the signature algorithm and
a signature made with the matching private key. This decoder base64-decodes the PEM body and
walks the raw DER/ASN.1 bytes by hand — no crypto library — to pull out every field, exactly
like openssl req -in request.csr -noout -text would.
As well as the subject fields and the Subject Alternative Names inside the
extensionRequest attribute (OID 1.2.840.113549.1.9.14), it reports the key
algorithm and size, the signature algorithm, the SHA-256 fingerprint of the whole request and
the SHA-256 fingerprint of the public key — the second one is what you compare against
openssl pkey -pubin -outform DER | openssl dgst -sha256 to prove a CSR matches a
key. The browser's Web Crypto API then re-verifies the CSR's own signature, which is the
proof-of-possession a CA checks.
The Checks section flags the things that get a request rejected: an RSA key under 2048 bits, a SHA-1 signature, a missing Subject Alternative Name, or a common name that does not appear among the SAN entries (public CAs have ignored the CN for host matching since 2017). All of this happens in your browser — the request is parsed with JavaScript on this page and is never uploaded, logged or stored. A CSR contains only your public key, so it is safe to inspect; a private key is not, and this tool refuses to read one.
Frequently asked questions
How do I decode a CSR without OpenSSL?
Paste the PEM block (or open the .csr file) and this page decodes it instantly. It base64-decodes the request and walks the raw DER/ASN.1 bytes in JavaScript, so you get the same fields as "openssl req -in request.csr -noout -text": the PKCS#10 version, the full subject distinguished name, the public key algorithm and size, the RSA exponent or the named curve, every Subject Alternative Name in the extensionRequest attribute, key usage, extended key usage, basic constraints and any challenge password. No installation, no command line and no server round trip.
Is it safe to decode a CSR online?
With this tool, yes. The request is parsed entirely in your browser and is never uploaded, logged or stored, which you can confirm by disconnecting from the network and watching the page keep working. That matters even though a CSR only contains a public key: it also carries your organisation name, location and the hostnames you are about to certify, which most CA-run decoders happily log. A private key is a different story, so never paste one into any website; this tool detects a private-key PEM and refuses to read it.
How do I check that a CSR matches my private key?
Compare public key fingerprints. This page prints the SHA-256 hash of the request's SubjectPublicKeyInfo, which is the same value you get locally from "openssl pkey -in private.key -pubout -outform DER | openssl dgst -sha256". If the two hashes match, the CSR was made with that key. The page also re-verifies the CSR's own signature with the Web Crypto API, and a valid self-signature proves whoever created the request held the matching private key, which is exactly the proof of possession a CA checks.