Free SSL tools
Everything you need to inspect, create and convert SSL/TLS certificates. No signup, no limits — and everything but the live checker runs entirely in your browser.
SSL Checker
Check a live site’s certificate: expiry, issuer, chain and hostname match.
SSL Certificate Decoder
Paste a PEM certificate and read every field — subject, SANs, dates, key, extensions.
Runs in your browser
CSR Decoder
Check what a certificate signing request actually asks for before you submit it.
Runs in your browser
CSR Generator
Generate a key pair and CSR in your browser — the key never leaves the page.
Runs in your browser
SSL Key Matcher
Confirm a certificate, CSR and private key belong to the same key pair.
Runs in your browser
SSL Converter
Convert between PEM and DER, and split a bundle into its individual certificates.
Runs in your browser
Why these run in your browser
Most online SSL tools post whatever you paste to a server. That is fine for a public certificate, and genuinely risky for a private key or an unissued CSR — you are trusting a stranger with material that protects your traffic. Parsing a certificate is just byte arithmetic, so there is no reason for it to leave your machine. Ours do the work in the page: open your browser’s network tab while you decode something and you will see no request go out. The one exception is the SSL checker, which has to open a real TLS connection from our side to see what the host actually serves.
Free SSL tools FAQ
Are these SSL tools really free?
Yes — every tool here is free, with no signup, no rate-limited “pro” tier and no watermarked output. They exist because they cost us almost nothing to run: five of the six do their work in your browser, so there is no server bill to recover. We hope you like them enough to try our certificate monitoring, but nothing here is gated on that.
Do you see the certificates and keys I paste in?
For the decoder, CSR decoder, CSR generator, key matcher and converter: no. Those run entirely as JavaScript in your browser — no request is made, so there is nothing for us to log or store. The SSL checker is the exception: it has to connect to the host you name from our servers, because that is the whole point of checking a live site.
Which tool do I need?
To find out why a live site is failing, use the SSL checker. To read what is inside a certificate file you already have, use the certificate decoder. Before submitting a CSR to a certificate authority, check it with the CSR decoder. To create a new CSR and key, use the CSR generator. If a server refuses to start with a key mismatch error, use the key matcher. If a system demands a different file format, use the converter.
Can I use these tools for internal or private certificates?
The browser-based tools work on anything you can paste, including internal CA and self-signed certificates — nothing has to be publicly reachable. The live SSL checker needs to reach the host from the public internet; for certificates on private networks, our monitoring agent handles that instead.
Do I need OpenSSL installed?
No. These cover the everyday openssl x509, openssl req and openssl rsa invocations without the man page — useful when you are on a machine without OpenSSL, on Windows, or simply cannot remember the flag order. If you prefer the command line, each tool page shows the equivalent command.
Stop checking by hand
SSLNudge re-checks your certificates daily and alerts you weeks before one expires.