What is the difference between BER and DER?
BER permits multiple valid encodings for some ASN.1 values. DER is a restricted BER profile that selects one canonical encoding, including definite minimal lengths and canonical primitive values.
ASN.1 DER / BER Decoder
Decode DER, BER, PEM, Base64, or hex into an offset-aware ASN.1 TLV tree; inspect universal values, OIDs, embedded structures, and canonical DER diagnostics.
Decode ASN.1 DER or BER data
The source is parsed in a browser worker. No certificate, key, CMS, or other binary value is uploaded, executed, verified, or sent to a remote endpoint.
Choose a local binary or PEM file to inspect.
ASN.1 analysis
TLV nodes, offsets, decoded values, OID names, DER/BER diagnostics, and correlated source bytes will appear here.
Offset-aware ASN.1 structure analysis
DecodeLens keeps every tag, length, content, and total range tied to the original bytes; resolves common PKI and cryptographic OIDs offline; and labels embedded ASN.1 interpretations as heuristics instead of schema facts.
ASN.1 and DER/BER boundaries
- Supports BER/DER TLV structure, universal primitive values, constructed values, indefinite lengths, multiple PEM blocks, and common PKI OIDs.
- A structurally DER-compatible result does not prove that an application schema, signature, certificate chain, key, or trust decision is valid.
- Embedded ASN.1 in BIT STRING or OCTET STRING is expanded only when the complete payload has a plausible TLV shape and remains explicitly heuristic.
- Private-key values are hidden by default in the result, but the original bytes remain in browser memory for local inspection and explicit download.
- The inspector never re-encodes or modifies ASN.1. Use the exact source bytes when byte-for-byte identity matters.
Related tools for this workflow
Continue with tools that decode, convert, inspect, or verify the same data.
- Security & identity
X.509 / PEM Certificate Decoder & Inspector
Inspect PEM or DER certificates, identity, validity, algorithms, SANs, extensions, fingerprints, and chain signatures.
Open tool - PKI & certificates
CSR Decoder & PKCS#10 Inspector
Decode DER, Base64, hex, or file-based PKCS#10 certificate requests and inspect the subject, public key, SANs, requested extensions, attributes, and self-signature.
Open tool - PKI & certificates
PKCS#7 / CMS Inspector
Inspect CMS and PKCS#7 content types, SignedData certificates and signers, EnvelopedData recipients, digest metadata, embedded content, and ASN.1 offsets.
Open tool - Binary analysis
Hex Viewer & Binary Inspector
Inspect file bytes, pasted hex, offsets, ASCII, numeric values, and magic-byte signatures.
Open tool
Read DER bytes as a TLV tree
Load the example to correlate SEQUENCE, INTEGER, SHA-256 OID, and UTF8String nodes with their original offsets and lengths.
DER hex
30 1A 02 01 2A 06 09 60 86 48 01 65 03 04 02 01…Decoded nodes
SEQUENCE → INTEGER 42 · OID 2.16.840.1.101.3.4.2.1 · UTF8String DecodeLensASN.1 DER / BER Decoder FAQ
Does DER-compatible mean a certificate is valid?
No. It only means the supported structural canonicalization checks found no problem. Certificate parsing, signature verification, chain building, time validity, and trust are separate checks.
Why is embedded ASN.1 marked as heuristic?
OCTET STRING and BIT STRING can contain arbitrary bytes. A payload that parses cleanly as TLV data may still have a different application-defined meaning without a schema or surrounding OID.