What is the difference between PKCS#7 and CMS?
CMS is the IETF standards-track evolution of PKCS#7. Existing PKCS#7 files and MIME labels are still common, so this inspector accepts both names and their usual file extensions.
PKCS#7 / CMS Inspector
Decode PEM, DER, Base64, or hex CMS messages. Inspect SignedData certificates and signers, EnvelopedData recipients and encryption metadata, embedded content, and the underlying ASN.1 structure.
Inspect a PKCS#7 or CMS message
The message is parsed in a browser worker. Embedded content is never executed, encrypted content is not decrypted, and remote certificate or revocation URLs are not contacted.
Choose a P7B, P7C, P7M, P7S, CMS, PEM, or DER file.
CMS details
Content type, CMS version, signers, certificates, recipients, algorithms, embedded content, and the ASN.1 structure will appear here.
Understand what a PKCS#7 or CMS container carries
DecodeLens identifies all standard CMS content types and provides deeper local inspection for SignedData and EnvelopedData. Embedded X.509 certificates, signer identifiers, digest metadata, recipients, encryption algorithms, and source offsets remain linked to the original ASN.1 bytes.
Inspection and cryptographic boundaries
- Recognizes Data, SignedData, EnvelopedData, DigestedData, EncryptedData, AuthenticatedData, and unknown content-type OIDs.
- SignedData and EnvelopedData receive semantic inspection; other recognized types remain available through their content type and ASN.1 tree.
- A matching messageDigest attribute checks embedded-content consistency only; it is not CMS signature or certificate trust validation.
- Encrypted or enveloped content is not decrypted and no private key or password workflow is enabled.
- Embedded content is never executed, and certificate AIA, OCSP, CRL, or other remote URLs are not requested.
Related tools for this workflow
Continue with tools that decode, convert, inspect, or verify the same data.
- Security & identity
X.509 / PEM Certificate Decoder & Inspector
Inspect PEM or DER certificates, identity, validity, algorithms, SANs, extensions, fingerprints, and chain signatures.
Open tool - Binary analysis
ASN.1 DER / BER Decoder
Decode DER, BER, Base64, hex, or binary files into an offset-aware ASN.1 TLV tree with OID names and canonical DER diagnostics.
Open tool - PKI & certificates
.mobileprovision Inspector
Decode Apple provisioning profiles through CMS and plist layers; inspect App ID, team, expiration, device scope, entitlements, and developer certificates.
Open tool - PKI & certificates
CRL Decoder & Inspector
Decode X.509 CRLs, inspect update windows and extensions, search revoked serial numbers, and optionally verify the signature with an issuer certificate.
Open tool
Inspect a SignedData container
Load a P7B, P7M, P7S, PEM, DER, or Base64 message. Review its CMS content type, embedded certificates, signer identifier, digest metadata, and whether content is embedded or detached.
CMS SignedData
ContentInfo → signedData → certificates + signerInfosInspection result
SignedData · 1 certificate · 1 signer
SHA-256 content digest: matched
CMS signature: not verifiedPKCS#7 / CMS Inspector FAQ
Does an embedded certificate prove the CMS signature is valid?
No. A certificate may be included without matching a signer, and even a matching certificate is not automatically trusted. This version reports structure and content-digest consistency without claiming CMS signature or trust validation.
Can this tool decrypt EnvelopedData?
No. It shows recipient and encryption metadata but does not load private keys, request passwords, or decrypt content.