CSR Decoder
This free CSR decoder reads a pasted certificate signing request and shows the domains, company details and key it contains, and checks its signature, all in your browser, so you can catch mistakes before you send it to a certificate authority.
Decoded in your browser: the request is never sent to us and nothing goes into the page address. Never paste a private key.
Free, no signup.
What is a CSR?
A certificate signing request (CSR) is the form you hand to a certificate authority when you order an SSL certificate. It holds your public key, the domain names you want covered, and details like your company name and country.
It is signed with your private key to show the request really came from whoever holds that key. The CSR itself is not secret: it only contains public information, so pasting one here is safe.
What to check before you send a CSR
Look at the domain names first. Browsers match the address bar against the Subject Alternative Names, so every name you want covered, with and without www, should be in that list. The common name should be one of them.
Then check the key and the details. An RSA key should be at least 2048 bits, and the country must be a two-letter code such as DE. Once a certificate is issued you cannot change the names on it, so a typo here means asking for a reissue with a new CSR.
Why the signature check matters
A CSR carries a signature made with the private key. Your browser can check it against the public key inside the request. If it says Verified, the request is intact and matches the key it contains.
If it says Does not match, the file was damaged or edited after it was signed, perhaps by a stray character when copying. Generate a fresh one rather than sending it. Some key types can't be checked in the browser, and then we say so instead of guessing.
Lost the private key?
A CSR cannot give you the private key back. If you no longer have the key that made the request, a certificate issued from it would be useless, because you could never install it. Start again with a new key and a new CSR.
You can make both in your browser with our CSR Generator, and the private key never leaves your device. Keep it somewhere safe: you will need it again when you install the certificate.
Frequently asked questions
Is it safe to paste my CSR here?
Yes. A CSR holds only public information, and this page decodes it in your browser without sending it anywhere. Never paste your private key into any website; if you do, this tool refuses to read it.
What does Verified mean?
It means the signature inside the request matches the public key inside the request, so the file is intact. It does not prove who you are: the certificate authority does that when it validates your domain.
Why does it say the CN is not among the SANs?
Browsers check the Subject Alternative Names, not the common name. Most authorities copy the common name into the SANs for you, but it is safest to list every name yourself.
Can I change the domain after I have sent the CSR?
No. The names are part of the signed request and then of the certificate. If a name is wrong, create a new CSR with the right ones and ask your CA for a reissue with it.
Which key size should I use?
RSA 2048 is the usual choice and the minimum most authorities accept. RSA 3072 or 4096 is slower and rarely needed. An EC P-256 key is smaller and faster, if your server and authority support it.
Can I decode a CSR without the BEGIN and END lines?
Yes. Paste the bare base64 and we'll try to read it. If it turns out to be a certificate instead, we'll point you to the SSL Certificate Decoder.
Dig deeper
SSL Certificate Decoder
Paste a PEM certificate or chain and see its domains, dates, issuer, key and fingerprints, decoded in your browser.
Decode certificateSSL Checker
Checks a site's certificate, chain, expiry date and TLS versions, and explains what's wrong in plain English.
Check a certificateCSR Generator
Create a CSR and private key for your SSL certificate in your browser. The key never leaves your computer.
Generate CSR