Paste public material to review its structure. Do not use production private keys; this inspector does not verify certificate trust chains, revocation or hostnames.
Runs locally in your browserFor certificates, the inspector reads container and common X.509 fields when available. It does not verify trust chains, revocation, hostname matching, or live server TLS.
Use public JWK sets for verification and key rotation review. Certificate trust, private-key handling, cryptographic policy, and production TLS configuration require their own dedicated controls.
Paste a PEM block, a certificate request, a JWK or a whole JWKS into the text area and read the decoded structure back: container sizes, X.509 fields, key algorithm and SHA-256 fingerprints. Everything is parsed in this tab, and the page sends no request while the inspection runs.
The DER reader was written for this tool. It walks the tag and length tree itself, so a body that is not valid base64 or a certificate that stops mid-structure is reported as an error instead of being guessed at. Encrypted private keys are recognised, never decrypted.
A certificate card lists the serial number without the DER sign byte, issuer, validity dates in UTC, subject, a public-key line such as RSA 2048 bit or EC (P-256, 256 bit), and a colon-separated SHA-256 fingerprint. A certificate whose validity has already ended, or has not started yet, is reported as a review item.
A private-key card adds the algorithm, key size and, for RSA, the public exponent read from the PKCS#8, PKCS#1 or SEC1 container. Legacy encryption headers (Proc-Type and DEK-Info) are treated as headers, so a traditionally encrypted key reports its payload size and cipher name instead of failing on invalid base64.
kty is required. RSA without n, EC without crv, x or y, and OKP without crv or x are errors; a symmetric oct key is flagged as a secret, and a key without kid is a review item because rotation and token verification get harder to trace.
Values that are present are checked too: a field that is not valid base64url, an RSA modulus below 2048 bits, and coordinates whose length does not match the declared curve are each reported with the field name.
Names are decoded from PrintableString, UTF8String, TeletexString, BMPString and UniversalString. Bytes that are valid UTF-8 are read as UTF-8, otherwise a Latin-1 mapping is used, which is what makes older certificates that carry UTF-8 inside a TeletexString field readable.
2,000 certificates (2.4 MB) rendered in about 0.25 s in a local test; much larger input belongs in a command-line tool. This inspector does not verify signatures, trust chains, revocation, hostname matching or live TLS, and it cannot decrypt an encrypted private key.