What this does
Paste a PKCS#10 Certificate Signing Request and see exactly what's inside it: the Subject fields, Subject Alternative Names, public key algorithm and size, signature algorithm, and — unlike just eyeballing the text — whether the signature actually verifies against the CSR's own embedded public key. This decodes any standard CSR, not just ones made with this site's own CSR Generator — it's been checked directly against real openssl req-generated requests, RSA and EC alike.
Why the signature check matters
A CSR's signature exists to prove whoever submitted it actually holds the private key matching the public key inside — that's the entire point of the request. This tool recomputes that check independently: it reads the embedded public key straight out of the CSR and verifies the signature against it, the same validation a certificate authority performs before ever looking at the Subject fields. A CSR that was corrupted in transit, edited by hand, or assembled with mismatched pieces fails this check even if every field looks fine at a glance.
What it doesn't do
Signature verification currently covers RSA keys only (RSASSA-PKCS1-v1.5, the near-universal default) — an EC-keyed CSR still decodes fully, including its curve name, but the signature itself isn't verified yet. This also only reads a CSR, not a certificate — a CSR and an issued certificate are different formats with different fields, even though a certificate's Subject usually started life as exactly this.
FAQ
Where would I get a CSR to decode?
Anywhere one was generated — openssl req -new, a control panel's "generate CSR" button, or this site's CSR Generator. Decoding one before submitting it to a CA is a quick way to confirm the Subject and SAN fields are actually what you intended.
Why does the signature check say it's not supported for my CSR?
Either the key is EC rather than RSA (verification for EC keys isn't implemented yet), or the signature uses an algorithm this tool doesn't recognize — the structure still decodes either way, just without that one check.
Is my CSR sent anywhere?
No — parsing and signature verification both run entirely in your browser. A CSR is already meant to be shared with a CA, so it contains no private key or secret to begin with, but nothing here is transmitted regardless.
Try it yourself
CSR Generator builds a CSR from scratch, with a new or existing RSA key pair, and RSA Key Pair Generator generates just the key pair on its own. Both run entirely in your browser.