PKCS#10 · Local browser processing

CSR Decoder.

Decode a CSR online and check its subject, SANs, public key, signature, and requested extensions before sending it to a certificate authority.

Browser-only parsing · Your CSR is not uploaded

Paste or upload your CSR.

Accepts PEM, legacy NEW CERTIFICATE REQUEST PEM, or Base64 DER.

Paste CSR text or upload a .csr, .p10, .req, .pem, or .der file.

Decoded CSR details.

Verify names and key details before submitting the request.

Your parsed CSR will appear here

The CSR decoder shows the subject, requested domains, public key, signature check, extensions, and request fingerprint.

A CSR contains a public key, not its matching private key. Keep the private key secret and verify the decoded values before sending the CSR to a certificate authority.

CSR DECODER OUTPUT

Read the request before a CA does.

A Certificate Signing Request is encoded, so a domain typo or missing SAN is easy to overlook. This CSR decoder exposes the fields that affect the certificate request while keeping the original CSR on your device.

Subject identity

Review the common name, organization, organizational unit, location, state, and country encoded in the request.

Requested hostnames

Inspect every DNS name or IP address in the Subject Alternative Name extension before certificate issuance.

Key and signature

Confirm the public-key algorithm and size, signature algorithm, self-signature status, and SHA-256 fingerprint.

PARSE CSR ONLINE

How to decode a CSR.

You only need the public Certificate Signing Request. Do not provide the private key that was created with it.

  1. 01

    Copy the complete request

    Include the BEGIN and END CERTIFICATE REQUEST lines. The CSR decoder also accepts a Base64-encoded DER request.

  2. 02

    Select Decode CSR

    The online CSR decoder parses the ASN.1 structure and verifies the request signature with its embedded public key.

  3. 03

    Compare every requested value

    Check the common name, SAN list, organization, key strength, and signature status against your intended certificate order.

AFTER DECODING

Use the result as a preflight check.

Compare the decoded CSR with the certificate you intend to order. If a name is missing or incorrect, create a new CSR from the original private key workflow; editing Base64 text will invalidate the signature.

Check these fields

  • Every production hostname appears in the SAN list
  • The organization and location match the order
  • The public key meets your CA or security policy
  • The CSR self-signature reports as valid

When a CSR cannot be parsed.

A CSR parser cannot recover a truncated request, repair changed Base64 data, or turn a private key or issued certificate into a CSR. Unsupported binary files must first be converted to PEM or Base64 DER.

A valid CSR signature confirms that the request has not been altered and was signed by the matching private key. It does not prove domain ownership or guarantee that a certificate authority will issue every requested extension.

OPENSSL ALTERNATIVE

Parse a CSR from the command line

openssl req -in request.csr -noout -text -verify

Use OpenSSL when you need local terminal output for a support ticket or an independent check against this CSR viewer.

RELATED TOOL

Need to create a request first?

Use the CSR Generator to create a new request and private key. Use this CSR Decoder when you already have a request and need to inspect it.

Decode CertificateCheck Certificate & KeyCheck CSR & KeyOpen CSR Generator

CSR DECODER FAQ

Common CSR decoding questions.

What is a CSR decoder?

A CSR decoder is a CSR viewer for PKCS#10 Certificate Signing Requests. It turns the encoded PEM or Base64 data into readable subject, hostname, public-key, signature, and extension fields.

Is it safe to use this online CSR decoder?

The CSR decoder runs locally in your browser and does not send the request to our server. A CSR contains a public key and identity details, not the private key. You should still never paste a private key into any CSR parser.

Why does the CSR parser show no SANs?

The request may have been created without a Subject Alternative Name extension. Modern certificate authorities use SANs for hostname coverage, so regenerate the CSR with every required domain before submitting it.

Can this tool decode a .csr or .p10 file?

Open a text-based .csr, .req, or .p10 file and paste its PEM content here. For binary DER, convert the file to Base64 DER or PEM first. This page does not upload files.

Why is the CSR signature invalid?

An invalid self-signature usually means the request is damaged, incomplete, or was altered after creation. Do not edit the encoded CSR. Generate a new request from the intended private key instead.