ASN.1 / DER Parser
Parse a DER-encoded ASN.1 structure (Base64 or hex — X.509 certificates, PKCS blobs, and other DER-based formats) into a tag/length/value tree.
Input
Output
| Depth | Tag | Length | Value |
|---|---|---|---|
| No data yet | |||
Guides
What is ASN.1 / DER?
ASN.1 (Abstract Syntax Notation One) is the data description language behind X.509 certificates, PKCS keys and signatures, LDAP, SNMP, and countless other protocols. DER (Distinguished Encoding Rules) is the binary encoding almost all of those formats use — every value is wrapped in a TLV (Tag-Length-Value) triplet: a tag byte identifying the type (INTEGER, SEQUENCE, OBJECT IDENTIFIER…), a length, and the value itself, which for container types (SEQUENCE, SET) is itself a run of nested TLVs. That nesting is what makes a raw certificate or key unreadable as plain bytes — this tool walks the TLV tree so you don't have to do it by hand.
How to use it
- Paste your DER-encoded data as Base64 or hex — the "Auto-detect" format usually gets it right, but you can force one explicitly if your input is ambiguous (e.g. all-numeric hex that also happens to look like Base64).
- The table updates live: each row is one TLV node, showing its Depth (nesting level), Tag (the ASN.1 type, with
(constructed)noted for container types), Length (content bytes), and Value. - Container types (SEQUENCE, SET, and constructed context-specific tags like
[0]) show an empty Value — their contents appear as child rows underneath, indented one depth deeper. - Copy the table or download it as CSV for further analysis.
How values are decoded
- INTEGER / ENUMERATED — shown as decimal for small values, hex for large ones (e.g. RSA moduli).
- OCTET STRING — hex dump of the raw bytes.
- BIT STRING — hex dump plus the unused-bit count from the leading byte.
- BOOLEAN —
TRUE/FALSE. - NULL — literal
NULL. - OBJECT IDENTIFIER — decoded to dotted notation (e.g.
1.2.840.113549.1.1.11). - UTF8String, PrintableString, IA5String and similar text types — decoded as text.
- Anything more exotic falls back to a plain hex dump of its value — still useful, just not further interpreted.
What this tool does not do
This is read-only structural parsing — it walks the tag/length/value tree but doesn't know the schema of any particular format (it won't label a SEQUENCE as "TBSCertificate" or a bit string as "signature"). It also doesn't encode ASN.1 or validate a structure against a spec. If a length is truncated or malformed, the affected row reports the error inline instead of failing the whole parse.
FAQ
Can I paste a full PEM certificate? Strip the -----BEGIN...----- / -----END...----- header and footer lines first and paste just the Base64 body between them.
Why does my input fail to parse? BER's indefinite-length encoding (a 0x80 length byte) isn't valid DER and isn't supported — re-export the data in DER form. Truncated or corrupted input also reports an inline error rather than a full structure.
Is my data uploaded anywhere? No — parsing runs entirely in your browser. The data you paste, including private keys if you paste one, never leaves your device.