Certificate Fingerprint Generator
Paste any PEM-encoded X.509 certificate to compute its SHA-1 and SHA-256 fingerprints. View both the colon-separated OpenSSL format and the raw hex representation with one-click copy support. All cryptographic operations run locally in your browser using the Web Crypto API - your certificate data is never uploaded.
Paste a PEM-encoded X.509 certificate to compute its SHA-1 and SHA-256 fingerprints using the Web Crypto API. All processing happens locally in your browser - no data is sent to any server.
Paste the full PEM including -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers
All processing happens locally in your browser using the Web Crypto API
Fingerprints are computed from the DER-encoded certificate bytes
Generated Fingerprints
No certificate parsed yet
Paste a PEM certificate and click "Generate Fingerprints"
Features
SHA-1 & SHA-256 Fingerprints
Computes both SHA-1 and SHA-256 fingerprints for any PEM-encoded X.509 certificate using the Web Crypto API. Each fingerprint is displayed in the familiar colon-separated format alongside the raw hex representation.
100% Private & Secure
All cryptographic operations happen locally in your browser using the built-in Web Crypto API (SubtleCrypto). Your certificate data never leaves your device - no uploads, no servers, no tracking. Perfect for sensitive internal certificates.
Instant Generation
Fingerprints are computed in milliseconds using the browser's native crypto primitives. No network requests, no server round-trips, no waiting. Paste your PEM and get results instantly.
One-Click Copy & Compare
Copy any fingerprint in colon-separated format or raw hex with a single click. Features an OpenSSL comparison guide so you can verify fingerprints against those generated by openssl x509 -fingerprint.
Use Cases
Certificate Verification & Auditing
Security professionals can compute fingerprints of certificates to verify their integrity. Compare fingerprints against known values from Certificate Transparency logs or vendor documentation to ensure certificates haven't been tampered with.
CI/CD Pipeline Certificate Validation
DevOps engineers can use the tool to generate fingerprints of certificates deployed in CI/CD pipelines. Pin certificate fingerprints in application code to ensure only trusted certificates are accepted, preventing man-in-the-middle attacks.
Certificate Pinning & HPKP Migration
Developers implementing certificate pinning (or migrating from HPKP) need certificate fingerprints to configure pin sets. Generate SHA-256 fingerprints for leaf and intermediate certificates to build accurate pin configurations for your applications.
About Certificate Fingerprints
What is a Certificate Fingerprint?
A certificate fingerprint is a cryptographic hash of the DER-encoded bytes of an X.509 certificate. Like a human fingerprint uniquely identifies a person, a certificate fingerprint uniquely identifies a specific certificate. Even the smallest change to the certificate content produces a completely different fingerprint. SHA-1 (160-bit) and SHA-256 (256-bit) are the most commonly used algorithms.
How Fingerprints Are Computed
The fingerprint is computed by taking the raw DER (Distinguished Encoding Rules) bytes of the certificate - the binary data between the PEM markers - and passing them through a cryptographic hash function. This tool uses the Web Crypto API (SubtleCrypto.digest()) for SHA-1 and SHA-256. The resulting hash bytes are formatted into the familiar colon-separated hexadecimal format (e.g., AA:BB:CC:DD:...). OpenSSL produces identical results with: openssl x509 -noout -fingerprint -sha256 -in cert.pem.
Certificate Fingerprint Uses
Certificate fingerprints are used for: certificate pinning (hard-coding acceptable fingerprints in applications), integrity verification (confirming a certificate hasn't been modified), certificate transparency log identification (tracking certificates by their fingerprint), HPKP (HTTP Public Key Pinning, now deprecated), and debugging SSL/TLS issues by comparing fingerprints against known values.
SHA-1 vs SHA-256 Fingerprints
SHA-1 fingerprints are 40 hex characters (20 bytes) long and are being phased out due to collision attacks. SHA-256 fingerprints are 64 hex characters (32 bytes) long and are the current security standard. Most modern tools and browsers prefer SHA-256 fingerprints. This tool generates both to support a wide range of compatibility needs, from legacy systems to modern security requirements.
Related Tools
DNS Propagation Checker
Check if DNS changes have propagated by querying multiple global nameservers (Cloudflare, Google, Quad9). Shows propagation status across regions with live results and colour-coded status indicators - free online DNS propagation checker.
Domain Age Checker
Check the age of any domain in years, months, weeks, and days. Enter a domain name to get its creation date, registration timeline, registrar info, and SEO authority estimate based on domain age - all fetched from the official RDAP registry in real time. Free online domain age checker.
Bulk WHOIS Lookup
Check domain registration information for up to 20 domains at once using the RDAP protocol. View registrar, creation date, expiry date, nameservers, and domain status codes in a sortable table - free online bulk WHOIS lookup.
Domain Expiry Checker
Check when any domain expires - enter a domain name to see its expiration date, days remaining, registrar lock status, auto-renew status, and complete WHOIS details. Colour-coded health indicators show whether renewal is urgent. Free online domain expiry checker.