Certificate decoder

No. It shows what’s inside and checks signatures between the certificates you paste, with your browser’s own cryptography. Trust depends on the root certificates your system or browser holds, and revocation on the issuer’s OCSP or CRL service; checking either means sending requests, which this page doesn’t do. The OCSP and CRL addresses are shown as text.

In a chain, each certificate is signed with the key of the one after it: the leaf by an intermediate, the intermediate by a root. The page checks each signature against the next certificate’s public key. A root signs itself. If your browser can’t do a signature’s algorithm, the card names the algorithm and says it can’t check. RSA-PSS signatures are checked; a public key restricted to RSA-PSS may not be accepted by your browser (Chrome doesn’t accept it), and then the card says so. If the next certificate’s name doesn’t match this certificate’s issuer, the chain is in the wrong order or a certificate is missing.

Don’t. The page recognises a private key and doesn’t decode it, but a private key shouldn’t be pasted into any website. If one was in use and you pasted it somewhere, replace it.

A hash of the whole certificate, the same value browsers show in their certificate viewer and openssl x509 -fingerprint -sha256 prints. Two certificates with the same fingerprint are the same certificate.

No. It’s decoded in your browser, and a file you open is read there too. It isn’t sent to our servers, put into the page address or saved.