CSR Decoder
Decode any PEM-encoded Certificate Signing Request (PKCS#10). Extract the subject fields, public key algorithm and key size, Subject Alternative Names (SANs), and signature algorithm. The tool also attempts to verify the self-signature using the Web Crypto API to confirm the CSR was generated by the private key holder. All processing is entirely client-side - your CSR never leaves your device. Free, no signup required.
Paste a Certificate Signing Request (CSR) in PEM format to decode and validate it. Extracts subject, public key algorithm, key size, Subject Alternative Names (SANs), challenge password, and signature algorithm. All processing is client-side.
Paste the full CSR including the BEGIN and END lines.
Comprehensive CSR Analysis
Decode and validate Certificate Signing Requests instantly.
Common Use Cases
From validation to education - CSR decoding serves many purposes.
CSR Validation Before Submission
Verify that your CSR is correctly formatted and contains the right subject fields, key algorithm, and key size before submitting it to your certificate authority.
Security Auditing
Check that CSRs in your infrastructure use appropriate key sizes (e.g., RSA 2048+ or ECDSA P-256+) and signature algorithms (SHA-256+).
Debugging Certificate Issues
When a certificate authority rejects your CSR, use this decoder to inspect the raw ASN.1 structure and identify formatting errors or missing fields.
Server Configuration Review
Review CSRs generated by your infrastructure to ensure they include the required Subject Alternative Names for multi-domain certificates.
Learning & Education
Use the decoded output to understand how PKCS#10 CSR structures work, what fields they contain, and how public key information is encoded.
Certificate Lifecycle Management
Track and verify CSR details during certificate renewal processes to ensure consistency between successive certificate requests.
About CSR Decoding
Understand how Certificate Signing Requests work and how they are parsed.
What Is a CSR?
How CSR Decoding Works
Signature Verification
Privacy & Security
Related Tools
More certificate and cryptography tools.
SSL Certificate Decoder
Decode and inspect any PEM-encoded SSL/TLS certificate. Extract subject, issuer, validity dates, SANs, and SHA-256 fingerprint.
Private Key Checker
Validate that a private key matches a certificate and CSR. Checks key type, size, and modulus match without exposing key content.
Self-Signed Certificate Generator
Generate self-signed SSL certificates for local development. Choose key type (RSA/ECDSA), key size, and validity period.
Certificate Fingerprint Generator
Compute SHA-1 and SHA-256 fingerprints of any PEM certificate. Shows the familiar colon-separated fingerprint format.
Frequently Asked Questions
Everything you need to know about decoding Certificate Signing Requests.
What is a Certificate Signing Request (CSR)?
A Certificate Signing Request (CSR) is a formatted message sent to a Certificate Authority (CA) to apply for a digital certificate. It contains the applicant's identifying information (Common Name, Organization, Location, etc.), the public key, and is signed with the corresponding private key. The standard format for CSRs is PKCS#10 (RFC 2986).
What information can I extract from a CSR?
Our decoder extracts: subject fields (CN, O, OU, L, ST, C, etc.), public key algorithm (RSA or EC), key size in bits, signature algorithm, Subject Alternative Names (DNS, IP, email), challenge password (if present), and verifies the self-signature.
What is the self-signature verification?
The self-signature in a CSR is a cryptographic signature created with the private key that corresponds to the public key in the CSR. Verifying it confirms that the requester possesses the private key without exposing it. If the signature is invalid, the CSR may have been tampered with or incorrectly generated.
What PEM formats are accepted?
The tool accepts any PEM-encoded CSR with standard headers like "-----BEGIN CERTIFICATE REQUEST-----" or "-----BEGIN NEW CERTIFICATE REQUEST-----". The PEM must include both the BEGIN and END lines with valid Base64-encoded DER content between them.
Is my CSR data stored or transmitted?
No. All CSR parsing and signature verification happens entirely in your browser using JavaScript. Your CSR is never sent to any server, never stored, and never logged. This is critical for security since CSRs contain sensitive public key information.
What key types and sizes are supported?
Both RSA and ECDSA (Elliptic Curve) public keys are supported. For RSA, the key size is calculated from the modulus. For ECDSA, we detect the curve from the OID and report the key size (e.g., P-256 = 256 bits, P-384 = 384 bits).
What does "Signature Not Verified" mean?
"Not Verified" means the signature could not be verified, which can happen for several reasons: the CSR uses an unsupported signature algorithm, the Web Crypto API cannot process the key type, or the browser environment lacks the required capabilities. This does not necessarily mean the CSR is invalid.
What are Subject Alternative Names (SANs) in a CSR?
Subject Alternative Names (SANs) specify additional domain names, IP addresses, or email addresses that the requested certificate should cover. They are included in the CSR's attributes section under the extensionRequest attribute. Modern browsers require SANs for all publicly trusted certificates.