b2KIT

ASN.1 / DER Decoder

Decode ASN.1 structures in DER or BER encoding. Visualize the TLV (Tag-Length-Value) tree for certificates and keys.

Tested tool guide Tested browser tools Checked August 15, 2026

What ASN.1 / DER Decoder does, with a checked example

This tool parses a pasted hex or base64 string of DER or BER encoded bytes and walks it tag by tag, printing the ASN.1 tag class, tag number, constructed-or-primitive flag, length, and decoded value at each nesting level. It renders the result as an indented tree, so a certificate's outer SEQUENCE, its SET OF name entries, and its OCTET STRING extensions become visible layers instead of a flat hex dump. The detail people get wrong: BER permits indefinite-length encoding (an 0x80 length octet, closed later by two zero bytes), which DER forbids, so BER structures using it can look truncated or malformed against a decoder expecting DER's definite-length rule.

Worked example

A concrete input and expected output from the current implementation.

Input

300602010502010A

Expected output

SEQUENCE (30), length 6
  INTEGER (02), length 1, value 5
  INTEGER (02), length 1, value 10

0x30 0x06 opens a SEQUENCE with 6 content bytes; those bytes split into two INTEGER TLVs, 02 01 05 (value 5) and 02 01 0A (value 10), which together consume exactly the 6 declared bytes.

How the result is produced

1

Tag and length parsing

Each element starts with an identifier octet encoding tag class (universal, application, context-specific, private), the constructed bit, and tag number, switching to the multi-byte high-tag-number form when the number exceeds 30. The next octet gives length in short form (a single byte under 128) or long form (a byte announcing how many following bytes hold the length); constructed tags recurse into child elements.

2

Value decoding by universal type

Primitive content with a recognized universal tag is decoded per that type: INTEGER as a signed big-endian number, OBJECT IDENTIFIER as dotted-decimal arcs, BIT STRING with its leading unused-bits count, and text types such as UTF8String or PrintableString as strings. Tags outside the universal class, or ones without a mapped type, are shown as raw hex.

Good uses

  • Inspecting the DER bytes of an X.509 certificate to see how its SEQUENCE, SET, and extension OCTET STRINGs nest before writing a parser against it
  • Debugging why a private key, CSR, or certificate fails to load in a library, by checking whether a tag or declared length doesn't match the actual bytes
  • Reading the OBJECT IDENTIFIER values inside a certificate's algorithm identifier or extensions to identify which algorithm or extension they name

Limits and checks

  • It reports structure, not validity - a syntactically well-formed tree does not mean the certificate's signature is correct or that it hasn't expired
  • Context-specific tags (common inside X.509 extensions and CHOICE fields) only carry a tag number, not a name, since resolving their meaning requires the governing ASN.1 module the decoder doesn't have
  • A declared length that exceeds the remaining input produces an incomplete or errored subtree rather than a guessed value, so a truncated paste can look like a malformed structure

Common questions

Does this check whether the certificate is valid or trusted?

No. It only decodes the byte structure into tags, lengths, and values. It does not verify the signature, check the chain of trust, or check expiry dates - use a certificate validation tool for that.

My certificate is in PEM format - can I paste that directly?

Strip the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines first. PEM is just base64-encoded DER wrapped in those header/footer lines, so once removed, the remaining base64 body is what a DER/BER decoder expects.

References and verification

The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools

Password Generator

Generate strong, random passwords with customizable length, character sets, and complexity requirements.

Password Strength Checker

Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.

Random String Generator

Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.

QR Code Generator

Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.

QR Code Reader

Scan and decode QR codes from uploaded images or your device camera to extract embedded data.

File Checksum Calculator

Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.