# CSR Decoder

Decode a PKCS #10 certificate signing request before you send it to a certificate authority. Paste the PEM block or base64 DER to see the subject, the public key type and size, the signature algorithm, whether the request's self signature verifies, the SPKI SHA-256 pin and the requested extensions such as subject alternative names, key usage, extended key usage and basic constraints.

## Frequently asked questions

### What is a certificate signing request?

A CSR is a PKCS #10 structure that holds your public key, the subject name you want in the certificate and optional extensions, signed with your private key. A certificate authority reads it to issue the certificate. The private key never leaves your server.

### Which input formats are accepted?

Paste the PEM block that starts with -----BEGIN CERTIFICATE REQUEST----- or the older -----BEGIN NEW CERTIFICATE REQUEST-----, or the raw DER encoded as base64 without headers. Only the first request in the input is decoded.

### What does the signature check tell me?

A CSR is signed with the private key that belongs to the public key inside it. A valid signature proves the request was created by whoever holds that private key and was not changed afterward. An invalid signature usually means the file was edited or damaged.

### Why does my CSR show no subject alternative names?

Browsers ignore the common name and require the domains in the subject alternative name extension. If the decoder lists none, the request did not include an extensionRequest attribute. Many CAs add the names themselves, but with OpenSSL you can add them with -addext "subjectAltName=DNS:example.com,DNS:www.example.com".

### What is the SPKI pin?

It is the base64 SHA-256 hash of the request's SubjectPublicKeyInfo. The certificate issued from this CSR will carry the same public key and therefore the same pin, which lets you confirm that a certificate belongs to your key.

### Which key types are recognized?

RSA requests show their modulus size, EC requests show their curve such as P-256 or P-384, and Ed25519 and Ed448 keys are named directly. The signature algorithm is shown with its hash, for example RSASSA-PKCS1-v1_5 with SHA-256 or ECDSA with SHA-384.

### Are attributes such as the challenge password shown?

Attributes other than the extension request are listed by name. A challenge password is reported as set, but its value is not printed in the result. Unknown attributes appear with their object identifier.

### What are critical extensions?

An extension marked critical must be understood by any software that processes the certificate, otherwise the certificate is rejected. The decoder marks such extensions, which is common for basic constraints and key usage.

### Is the CSR stored?

No. The request is decoded in memory and never logged or saved. A CSR contains only public data, so decoding it online does not expose your private key.

### Is there a size limit?

The input may be up to 65,536 characters, which is far more than any normal CSR needs. A typical RSA 2048 request is around 1,000 characters of PEM.

Your ad here?

[Email us](mailto:hi@dennn.is?subject=Advertising%20on%20OneClick%20Pro)

[Ad The agent-ready plugin suite for WordPress.](https://sleekwp.com/?ref=oneclickpro)