OneTaskBy Tim King · Updated
PEM Inspector
Named Object Identifiers and Nested Structures From PEM, Hex or Base64 DER
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the PEM Inspector works
This PEM inspector decodes keys, certificates, requests and any other DER data into an ASN.1 tree, in
the same layout as openssl asn1parse. Paste one or more PEM blocks, or raw DER as hex or Base64, and
see every sequence, integer, object identifier and string inside, decoded in your browser.
Reading the PEM inspector output
Each line shows the byte offset, the nesting depth d, the header length hl, the content length l,
whether the element is constructed (cons) or primitive (prim), and its type. Object identifiers are
shown with their names where known, such as rsaEncryption or prime256v1. Strings and times are shown
as text, and integers and binary values as hex, shortened with an ellipsis when longer than 32 bytes.
Nested structures
Keys and certificates often hide DER inside a BIT STRING or OCTET STRING, such as the public key inside a certificate or the curve key inside PKCS#8. The inspector detects these and decodes them in place, so you see the full structure rather than a blob of hex. Several PEM blocks, like a certificate chain, are decoded one after another.
FAQ
What can I use this for?
Checking which algorithm and curve a key uses, finding out why a library rejects a file, confirming that a certificate carries the extensions you expect, or learning how X.509 and PKCS formats are put together. It shows the raw structure, so nothing is hidden or interpreted away.
Does it support encrypted keys?
It decodes their structure, which shows the encryption scheme, the key derivation parameters and the encrypted data, but it cannot show the key itself without the passphrase. That is often enough to tell which cipher and iteration count a key was protected with.
Is my key or certificate uploaded?
No. Decoding happens entirely in your browser. Certificates are public anyway, but private keys should stay private, and nothing you paste here leaves the page or is stored.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
PEM To JWK Converter
Convert public and private keys between PEM and JWK.
CSR Decoder
Decode a CSR, verify its signature and spot problems before submitting.
SSL Certificate Inspector
Decode a PEM certificate and check its dates, names and fingerprints.
Base64 Encoder / Decoder
Encode and decode Base64, standard or URL-safe.
Certificate Chain Order Checker
Check your SSL certificate bundle is complete and in the right order.