CSR Decoder

About this tool

The CSR Decoder parses a PEM-encoded Certificate Signing Request and shows the subject details it carries, the requested Subject Alternative Names, the public key size and the signature algorithm. Paste the block between the BEGIN and END CERTIFICATE REQUEST lines to see exactly what a certificate authority will read.

The value is catching mistakes before they cost you a day. A CSR built from a hand-written OpenSSL config can easily carry a typo in the common name, the wrong country code, a missing SAN or an undersized key — none of which is visible in the encoded text. Fixing it after issuance means a reissue and a second round of validation. Decoding runs entirely in your browser, so nothing you paste is uploaded. If the details are wrong, the CSR generator will create a replacement key pair and request.

How to use it

Paste the CSR and select Decode CSR, then check the output against what you ordered:

• Common Name — must exactly match the primary hostname, with no scheme, port or trailing slash.
• Organization, locality, state and country — for OV and EV certificates these must match your registered company details or validation will stall.
• Subject Alternative Names — every hostname the certificate must cover should be listed, including the common name itself.
• Key size and signature algorithm — confirm both meet your baseline and the CA's minimum.
• If anything is wrong, generate a new key pair and CSR. A CSR is signed and cannot be edited without invalidating it.

Common questions

Is it safe to paste a CSR into a web tool?

A CSR contains no private key material, only your subject details and a public key, so it is not a secret in the way a private key is. Here the question is moot in any case: decoding happens entirely in your browser and nothing you paste is sent to us.

Why does my CSR show no Subject Alternative Names?

Because none were requested. OpenSSL does not add SANs from the command line by default; they have to be supplied through a config file or the relevant extension option. A CSR without SANs usually produces a certificate that modern browsers reject, so add them and regenerate before submitting.

Can I decode a CSR without the private key?

Yes. Everything shown is read from the CSR itself and no key is required. If you want to confirm that a private key belongs with a particular certificate, use the key and certificate matcher tool instead.