Best Online ASN.1 DER Parsers Compared (2026)
ASN.1 DER encoding is the backbone of X.509 certificates, PKCS standards, TLS handshakes, and smart card cryptography. When you need to inspect a certificate's internal structure, debug a PKCS#7/CMS message, or understand why a CSR was rejected, you need a reliable ASN.1 parser. We tested the top online ASN.1 DER decoders to help you choose.
Quick Comparison Table
| Feature | CardWise ASN.1 | lapo.it/asn1js | CertLogik | ASN1JS | OSS Snacc |
|---|---|---|---|---|---|
| Interactive tree view | Yes | Yes | Yes | Yes | No (text output) |
| Hex input | Yes | Yes | Yes | Yes | Yes |
| Base64 input | Yes | Yes | Yes | No | No |
| PEM input (auto-strip) | Yes | Yes | Yes | No | No |
| OID name resolution | Yes (500+ OIDs) | Yes (100+) | Yes (200+) | Limited | No |
| BIT STRING decode | Yes (binary view) | Yes | Yes | Yes | Yes |
| OCTET STRING nesting | Yes (auto-recurse) | Yes | Yes | Partial | No |
| X.509 field names | Yes | Partial | Yes | No | No |
| Client-side only | Yes (zero upload) | Yes | No (server) | Yes | No (server) |
| Real-time parsing | Yes (as-you-paste) | No | No | No | No |
| Mobile friendly | Yes | Basic | Yes | Basic | No |
| Privacy | Best (no server) | Good (client) | Poor (server) | Good (client) | Poor (server) |
| Price | Free | Free | Free | Free | Free |
1. CardWise ASN.1 DER Parser — Most Complete & Private
CardWise (formerly Cupass) offers the most comprehensive OID resolution database of any free online ASN.1 parser, with 500+ Object Identifiers mapped to human-readable names. It automatically recurses into nested OCTET STRING values (common in X.509 extensions and PKCS structures) and labels X.509 certificate fields by name.
Key advantages for developers and security engineers:
- Interactive tree view — expand/collapse nodes, click to see raw hex for each element
- Full OID resolution — 500+ OIDs including X.509, PKCS, RSA, ECDSA, SM2/SM3, and private enterprise OIDs
- Triple input mode — hex, Base64, or PEM (auto-strips
-----BEGIN-----headers) - Zero data upload — everything runs in your browser
- Auto-recurse OCTET STRING — automatically attempts to parse nested ASN.1 inside OCTET STRING values
- X.509 field labeling — shows "Subject", "Issuer", "Public Key", "Extensions" instead of raw ASN.1 tag names
2. lapo.it/asn1js — The Classic Open-Source Parser
lapo.it's asn1js is the most well-known open-source ASN.1 JavaScript parser, hosted on GitHub. It provides a clean tree view and has been used as a library in many other tools.
Pros: Open source (auditable), clean tree view, hex/Base64/PEM input, client-side, widely trusted.
Cons: Limited OID database (about 100), no X.509 field labeling, no real-time parsing, UI is functional but minimal.
3. CertLogik — Certificate-Focused
CertLogik provides ASN.1 parsing as part of a certificate analysis suite. It shows X.509 fields with names and includes certificate validation features.
Pros: Good X.509 field labeling, certificate chain validation, hex and PEM input, additional certificate analysis tools.
Cons: Server-side processing (your certificate data is uploaded), more complex UI focused on certificate validation rather than pure ASN.1 parsing, slower for quick inspections.
4. ASN1JS — Library Demo
ASN1JS is a JavaScript library demo that provides basic ASN.1 DER parsing with a tree view. It is primarily a showcase for the library.
Pros: Client-side, library available for integration, hex input.
Cons: No Base64 or PEM input, very limited OID resolution, no X.509 field labeling, no real-time parsing, minimal documentation.
5. OSS Snacc — Legacy Text Output
OSS Snacc provides a text-based ASN.1 parser that outputs a flat text representation of the DER structure. It is a legacy tool.
Pros: Can handle very large ASN.1 structures, text output is grep-friendly.
Cons: No tree view (text only), server-side processing, no OID resolution, no hex display, outdated UI, no mobile support.
Which ASN.1 Parser Should You Use?
| Use Case | Recommended Tool | Why |
|---|---|---|
| X.509 certificate inspection | CardWise ASN.1 | X.509 field names + OID resolution + privacy |
| PKCS#7/CMS message debugging | CardWise ASN.1 | OCTET STRING auto-recurse + tree view |
| Internal/private PKI certificates | CardWise ASN.1 | 100% client-side, no data upload |
| Open-source auditable parser | lapo.it/asn1js | GitHub source, trusted, client-side |
| Certificate chain validation | CertLogik | Chain validation beyond pure ASN.1 parsing |
| Very large structures (text grep) | OSS Snacc | Text output for batch analysis |
Common ASN.1 Types Quick Reference
| Tag (hex) | Type | Common Use |
|---|---|---|
| 0x30 | SEQUENCE | X.509 certificate, PKCS structures |
| 0x31 | SET | X.509 Distinguished Name attributes |
| 0x02 | INTEGER | RSA modulus/exponent, serial number |
| 0x06 | OBJECT IDENTIFIER (OID) | Algorithm identifiers (e.g., rsaEncryption 1.2.840.113549.1.1.1) |
| 0x03 | BIT STRING | Public keys, signature values |
| 0x04 | OCTET STRING | Extension values, key material, nested ASN.1 |
| 0x17 | UTCTime | Certificate validity (YYMMDDHHMMSSZ) |
| 0x18 | GeneralizedTime | Certificate validity (after 2050) |
| 0x13 | PrintableString | X.509 DN attributes (CN, O, OU) |
| 0x0C | UTF8String | International DN attributes |
| 0xA0 | CONTEXT [0] (explicit) | X.509 v3 extensions, version |
Frequently Asked Questions
What is the difference between DER and BER?
DER (Distinguished Encoding Rules) produces a unique binary representation for any given ASN.1 structure — there is only one valid DER encoding. BER (Basic Encoding Rules) allows multiple valid encodings for the same data (e.g., short-form vs. long-form length, constructed vs. primitive). DER is used in cryptography and certificates because unique encoding is required for signature verification. BER is used in some telecom and network protocols where flexibility is preferred.
Can I parse a PEM certificate with an ASN.1 decoder?
Yes. A PEM file is just Base64-encoded DER data wrapped in -----BEGIN CERTIFICATE----- / -----END CERTIFICATE----- headers. CardWise ASN.1 Parser automatically strips PEM headers and decodes the Base64 to DER, then parses the ASN.1 structure. You can also strip the headers yourself and paste the Base64 content.
Why does my certificate have nested OCTET STRING values?
This is common in X.509 v3 extensions. Each extension is encoded as a SEQUENCE containing an OID (extension type) and an OCTET STRING (extension value). The OCTET STRING itself often contains more DER-encoded ASN.1. For example, the Subject Key Identifier extension contains an OCTET STRING wrapping a KeyIdentifier OCTET STRING. CardWise auto-recurses into these nested structures to show you the full decoded tree.
What does OID 1.2.840.113549 mean?
That is the Root Agency / RSA Security LLC OID arc. sub-arcs include: 1.2.840.113549.1.1 (PKCS#1 RSA algorithms), 1.2.840.113549.1.5 (PKCS#5 password-based encryption), 1.2.840.113549.1.7 (PKCS#7/CMS), 1.2.840.113549.1.9 (PKCS#9 attribute types), 1.2.840.113549.1.12 (PKCS#12 PFX). CardWise resolves all of these to human-readable names.