Skip to content
Marvin's Toolbox.

ASN.1 and PKCS#12 Inspector

Decode any DER or PEM data into a browsable ASN.1 tree with named object identifiers and a linked hex view. Open PKCS#12 .p12 and .pfx bundles with their password to list the certificates and keys inside, and export them as PEM.

Runs entirely in your browser. Nothing you put in here gets uploaded.

Input

Binary file · Binary DER or any text form: .der, .cer, .crt, .pem, .p7b, .crl, .key

Nothing decoded yet

Paste PEM, base64 or hex above, or load a file, to browse its structure and bytes.

Next steps

Send this tool's output straight into another tool.

X.509 Certificate Decoder

Paste a PEM certificate to see its subject, issuer, validity dates, subject alternative names, key details, fingerprints and extensions in plain view.

securitydev

Config Converter

Convert config and data between JSON, YAML, TOML, JSON5, INI, XML, CSV and .env. Type or paste on the left, pick the output format on the right, and copy the result. Includes a format button and a minify toggle.

devconverterconfigjsonyaml

JSON Inspector

Paste JSON to explore it as a collapsible, searchable tree, hide the fields you don't need, and see the structure it implies as a badge-annotated schema and a copyable TypeScript interface.

devjson

JSON Diff

Compare two JSON documents by structure and see every added, removed and changed key and value with its exact path. Browse the result as a tree, a filterable change list or a line diff, ignore array order, catch type changes and export the changes as a JSON report.

devjson

Text Case Converter

Convert text into every case at once: title case in the APA, AP, Chicago, MLA, Bluebook, AMA and NYT styles, sentence case, upper, lower, camelCase, snake_case, kebab-case and more.

textconverterdev

Word & Character Counter

Count words, characters, sentences, paragraphs, lines and more as you type, with estimated reading and speaking time.

text

Dedupe Lines

Remove duplicate lines from a list or text, keeping the first occurrence. Optionally ignore case and whitespace, or drop blank lines too.

textdev

Find and Replace

Replace text in two modes: plain find and replace all, or regular expressions with flag controls and capture group references like $1.

textdev

Text Diff

Compare two texts and see every added, removed and changed line highlighted, side by side or inline, with the changed words marked within each line. Ignore case, whitespace or blank lines, read a summary of how much changed, and export the result as a unified diff.

textdev

About the ASN.1 and PKCS#12 Inspector Tool

This tool decodes any DER or BER data into a browsable ASN.1 tree and opens PKCS#12 bundles. Paste PEM with any label, base64 or hex, or load a binary file, and the format is detected for you. Every object identifier gets its name, integers, times and strings are decoded, and DER hidden inside an OCTET STRING or BIT STRING opens as children.

Selecting a node colors its tag, length and value in the hex dump next to the tree, and clicking a byte selects the node that holds it. In PKCS#12 mode a .p12 or .pfx file and its password list the certificates and private keys inside, show which key belongs to which certificate, and export everything as PEM.

What you can do

  • Decode a DER or PEM file into an ASN.1 tree
  • Look up what an OID in a certificate means
  • See which bytes of a certificate encode which field
  • Find where a damaged or truncated DER file breaks
  • Open a PFX file and list its certificates and private keys
  • Extract a certificate and private key from a .p12 file as PEM
  • Export the full certificate chain from a PKCS#12 bundle
  • Check which private key matches which certificate
  • Check whether a PFX uses legacy RC2 and 3DES or modern AES encryption

How to use the ASN.1 and PKCS#12 Inspector

  1. 1Stay on the ASN.1 tab to read raw data, or switch to PKCS#12 for a bundle.
  2. 2Paste or drop your data. A PKCS#12 file with a password asks for it after loading.
  3. 3Browse the tree, or search by OID, name, type or value.
  4. 4Select a node to see its bytes, or copy and download what you need as PEM, hex or JSON.

What the ASN.1 mode reads

All universal types decode to something readable: arbitrary-size integers, object identifiers, bit strings, reals, UTCTime and GeneralizedTime values and every string type from PrintableString to BMPString. High tag numbers, long-form and indefinite lengths and constructed strings are all handled, and context and application tags show their number. The name table covers X.500 attributes, X.509 extensions, signature and hash algorithms, PKCS and CMS identifiers, named curves and the post-quantum algorithms.

Damaged data still shows every node read up to the point of failure, with the byte position of each problem as a link into the hex dump. A guess at encapsulated DER can be wrong for bytes that merely look like a structure, so a switch turns it off. The parser stops at 64 levels of nesting and 250,000 nodes.

Opening PKCS#12 bundles

Legacy bundles with RC2 and 3DES open as well as modern ones with AES and PBKDF2, including those with the newer PBMAC1 integrity check. A bundle with an empty password opens right away. A wrong password gets a different message from a damaged file: the tool tries to decrypt a block when the integrity check fails, because only the right password can do that.

Certificates list their subject, issuer, validity with expired ones marked, serial number, SHA-256 fingerprint and CA flag, in chain order with the leaf first. Keys are matched by comparing public keys, and by local key ID when that is not possible. Private keys stay hidden until you reveal or export one, and the exported PEM is not encrypted, so treat it like a password. To read one certificate field by field, send it to the X.509 Certificate Decoder.

Credits

Open source does the heavy lifting in this tool. Thank you to:

  • Forge

    A native JavaScript implementation of TLS and the cryptography around it.

Everything this site builds on is listed on the credits page.

Related tools

Tools that share a tag with this one.

Bcrypt & Argon2 Generator

Hash a password with bcrypt or Argon2 and verify a password against an existing hash. Tune the cost factor, memory, iterations and parallelism, see how long the hash takes, and read the parsed parts of any hash you paste.

securitydev

Checksum Validator

Verify a file against its checksum. Drop the file and paste the expected hash or a sha256sum line, and the hash type is detected for you, from MD5 to BLAKE3.

devsecurity

CSP Builder

Build a Content-Security-Policy header directive by directive, or paste an existing policy to check it. Weak spots like unsafe-inline, wildcards and missing directives are flagged with what to do instead.

securitydev

CSR Generator

Create a certificate signing request with a fresh RSA or ECDSA key or your own. Fill in the subject and subject alternative names, then download the CSR and private key as PEM, with the matching openssl command alongside.

securitydev

Email Header Analyzer

Paste raw email headers to trace the Received chain hop by hop with per-hop delays, read the SPF, DKIM and DMARC results, and see every header explained. Helps you spot spoofing and find where a slow email got stuck.

devsecurity

Hash Generator

Hash text or a file with MD5, SHA-1, SHA-256, SHA-512, SHA-3, BLAKE2, BLAKE3, CRC32 and more, all computed live as you type. Compare against an expected checksum and copy any digest.

devsecurity