CSR Decoder Online - Decode and Check a CSR

Q: How do I decode a CSR with openssl instead?

Run openssl req -in request.csr -noout -text -verify. That prints the subject, the key size, any requested SANs and the signature algorithm, and -verify confirms the CSR was signed by the key it claims.

What a CSR holds, and where this one is decoded

A certificate signing request is a PKCS#10 structure: the subject name you asked for, your public key, and a signature made with the matching private key to prove you hold it. That structure is binary DER, base64-encoded and wrapped between -----BEGIN CERTIFICATE REQUEST----- and the matching END line to make the PEM text you paste above. The private key is never inside a CSR.

This page does not parse the request in your browser. It checks the text locally - both marker lines, a body of base64 characters, at least 200 of them - then posts the whole PEM block to the SimpleMoney API, which decodes it and returns the fields. A CSR is public by design, since you are about to hand identical bytes to a certificate authority, but it does leave your machine.

The fields it reads back

CN	Common name - the hostname the certificate is for
O, OU	Organisation and organisational unit
L, ST, C	Locality, state, two-letter country
Key type, size	RSA or EC, and the bit length

Blank fields are omitted. Subject alternative names, the signature algorithm and the self-signature check are not shown here, and browsers ignore CN in favour of the SAN list, so confirm those locally:

openssl req -in request.csr -noout -text -verify

A request exported by Windows certreq often begins -----BEGIN NEW CERTIFICATE REQUEST-----. The check rejects that header outright. Delete the word NEW from both lines and it decodes.

Frequently asked questions

Does a CSR contain my private key?

No. It carries the public key and your subject details, signed by the private key. It can be posted in a support ticket without harm. If anyone asks for the .key file too, they want the wrong file.

How do I decode a CSR with openssl instead?

Run openssl req -in request.csr -noout -text -verify. That prints the subject, the key size, any requested SANs and the signature algorithm, and -verify confirms the CSR was signed by the key it claims.

Why is the Decode button greyed out?

The paste failed a local check: a truncated copy under 200 base64 characters, quote marks picked up from an email, or the NEW CERTIFICATE REQUEST header. Re-copy the file from the first dash to the last.

🔐 CSR Decoder