CSR decoder
Read a CSR before you sign it: subject, requested SANs and extensions, public key details, signature algorithm — and whether the CSR’s own signature verifies.
Runs locally in your browser — nothing is uploaded
Decoded signing request
signature not checkedSubject alternative names (requested)
Requested extensions
ASN.1 as JSON
Long values are truncated with a byte count.
Questions
What is checked automatically?
The CSR signature is verified against its own public key — that proves the request was signed by the private key that matches the included public key. Nothing else is trusted or verified.
What does a valid CSR signature tell me?
It tells you the request is internally consistent: whoever created it held the private key at signing time. It does not tell you who they are — that is the CA’s job.
Can I decode an EC key CSR?
Not in v1 — CertKit parses RSA objects only and reports a friendly unsupported error. EC support is the first item on the roadmap.
Is the CSR uploaded anywhere?
No. The request is parsed by JavaScript in this tab. There are no network calls in the flow — verifiable in DevTools → Network.
How this runs locally
CertKit is a static site. Parsing and cryptography run inside this browser tab using a vendored copy of node-forge 1.4.0 served from this domain. Open DevTools → Network, run the tool, and you will see no request that contains your file — nothing is uploaded, and nothing is stored.