DER ASN.1 Binary Decoder

ASN.1 DER Decoder

Use this ASN.1 DER Decoder to inspect hexadecimal Distinguished Encoding Rules data. Decode ASN.1 tags, definite lengths, SEQUENCE and SET containers, INTEGER values, OBJECT IDENTIFIER values, BIT STRING, OCTET STRING, text strings, BOOLEAN, NULL and common ASN.1 time types.

✓ Nested ASN.1 ✓ INTEGER ✓ OID Decoder ✓ BIT / OCTET STRING ✓ DER Checks

ASN.1

Decode DER Hex

● Ready

ASN.1 DER Hex Bytes Enter hexadecimal DER bytes. Spaces, commas, colons, hyphens and 0x prefixes are accepted. The decoder expects one complete top-level DER object.

DER validation scope: this decoder applies structural DER rules and several important canonical checks including definite length, minimal length encoding, minimal INTEGER encoding, canonical BOOLEAN content, NULL length and BIT STRING padding. Full ASN.1 schema validation requires the original ASN.1 type definition and is outside a schema-free decoder.

ASN.1 DER Result Decoded

Decoded ASN.1 Structure –

Input Bytes –

ASN.1 Items –

Constructed –

Primitive –

Maximum Depth –

OID Values –

Canonical Warnings –

Top-Level Type –

#	Path	Offset	Tag	Class	Type	Length	Decoded Value	DER Status	Encoded Bytes

ASN.1 DER Decode Breakdown

Normalized DER Bytes

–

What Is an ASN.1 DER Decoder?

An ASN.1 DER Decoder reads binary data encoded using Distinguished Encoding Rules and displays its identifier, length and content structure. DER is widely used where a single canonical binary representation is required, including X.509 certificates, cryptographic keys, certificate requests and many security-related ASN.1 structures.

DER uses the same fundamental Tag-Length-Value structure as BER but removes encoding choices that would allow the same ASN.1 value to have several different binary representations.

DER Tag-Length-Value Structure

DER Item =
Identifier + Length + Contents

The identifier contains ASN.1 class, primitive/constructed state and tag number. The length states exactly how many content octets follow.

Unlike general BER, DER does not use indefinite-length encoding.

ASN.1 Universal Tags

Tag	ASN.1 Type	Typical DER Content
01	BOOLEAN	00 for false or FF for true
02	INTEGER	Minimal signed two’s-complement bytes
03	BIT STRING	Unused-bit count followed by bit data
04	OCTET STRING	Arbitrary bytes
05	NULL	Zero content bytes
06	OBJECT IDENTIFIER	Base-128 encoded OID arcs
0C	UTF8String	UTF-8 text
10 / 30	SEQUENCE	Constructed ordered ASN.1 values
11 / 31	SET	Constructed ASN.1 values
17	UTCTime	Compact UTC date/time representation
18	GeneralizedTime	Four-digit-year date/time representation

DER vs BER

BER

Allows multiple valid encodings for some ASN.1 values, including definite and constructed indefinite-length forms.

DER

Chooses one deterministic representation so the same ASN.1 value has a stable binary encoding.

This property is important for digital signatures. If semantically identical data could be serialized in several different ways, signing the binary form would be more difficult to make deterministic.

DER Definite Length Encoding

DER always uses definite-length encoding. For values up to 127 bytes, the length is represented directly by one octet.

05
→ 5 content bytes

7F
→ 127 content bytes

For larger content, the long form states how many subsequent octets encode the actual length.

81 80
→ 128 bytes

82 01 00
→ 256 bytes

DER also requires the length representation to be minimal. A value of 127 should therefore not be unnecessarily encoded using the long form.

ASN.1 INTEGER Decoding

ASN.1 INTEGER contents are signed two’s-complement bytes. The high bit of the first content octet determines the sign.

02 02 01 00

02
→ INTEGER

02
→ length 2

01 00
→ 0x0100
→ 256 decimal

Negative values use two’s-complement representation.

DER INTEGER Canonical Encoding

DER requires INTEGER content to use the minimum number of octets needed to preserve its signed value.

Valid positive 127:
02 01 7F

Positive 128 requires leading 00:
02 02 00 80

The leading zero in the second example is required because without it the high bit of 80 would indicate a negative integer.

However, redundant leading 00 or FF sign-extension octets make the INTEGER non-canonical.

OBJECT IDENTIFIER Decoder

ASN.1 OBJECT IDENTIFIER values identify algorithms, attribute types, certificate extensions and many other standardized objects.

The first two OID arcs are combined into the first encoded subidentifier, while subsequent arcs are represented using base-128 groups.

06 09
2A 86 48 86 F7 0D 01 01 0B

Decoded OID:
1.2.840.113549.1.1.11

That OID is commonly associated with SHA-256 with RSA encryption/signature algorithm identifiers.

DER BOOLEAN

ASN.1 BOOLEAN contains one content octet. Under DER the canonical encodings are:

01 01 00
→ FALSE

01 01 FF
→ TRUE

Other non-zero BER BOOLEAN values can represent true under BER semantics, but DER requires the canonical true content octet FF.

DER NULL

ASN.1 NULL has no content bytes:

05 00

A NULL value with a non-zero content length is invalid for DER.

DER BIT STRING

The first content octet of a BIT STRING states how many unused bits appear at the end of the final data octet.

03 02 00 A0

03
→ BIT STRING

02
→ 2 content bytes

00
→ 0 unused bits

A0
→ bit data

The unused-bit count must be from zero through seven. When unused bits exist, the corresponding low bits of the final content octet must be zero in DER.

DER OCTET STRING

OCTET STRING represents arbitrary bytes. Those bytes might contain plain binary data, an embedded DER object or protocol-specific information depending on the surrounding ASN.1 schema.

The decoder therefore keeps the hexadecimal bytes as the authoritative value and only adds a readable text preview when the bytes safely decode as text.

DER SEQUENCE

SEQUENCE is a constructed universal ASN.1 type whose content contains encoded child elements.

30 0A
02 01 01
04 05 68 65 6C 6C 6F

Here the outer SEQUENCE contains an INTEGER followed by an OCTET STRING. The decoder recursively follows these child boundaries.

DER SET

SET is another constructed universal ASN.1 type. DER applies canonical ordering rules to SET components so equivalent values receive deterministic encodings.

This tool identifies SET structures, but complete schema-aware SET ordering validation can require knowledge of the ASN.1 type definition. The decoder does not falsely claim complete schema-level validation.

UTF8String and Other ASN.1 String Types

ASN.1 defines several character-string types. This decoder recognizes common universal types including UTF8String, PrintableString, IA5String, VisibleString, BMPString and related string tags.

For UTF8String the bytes are validated as UTF-8 before text is displayed. Other recognized character strings receive a readable preview where appropriate.

ASN.1 UTCTime

UTCTime is commonly encountered in X.509 certificate validity periods. Its ASN.1 universal tag is 23, encoded as hexadecimal tag 17.

17 0D
32 36 30 39 30 31
31 30 30 30 30 30
5A

Text:
260901100000Z

The decoder displays the encoded date/time text rather than silently changing timezone semantics.

ASN.1 GeneralizedTime

GeneralizedTime uses universal tag 24, hexadecimal 18, and can represent a four-digit year.

20260901100000Z

It is commonly used where the two-digit year range of UTCTime is not suitable.

DER in X.509 Certificates

X.509 certificates are ASN.1 structures normally serialized in DER. A PEM certificate is essentially DER certificate bytes represented using Base64 and surrounded by textual BEGIN/END lines.

Once the PEM armor and Base64 transformation are removed, the underlying certificate structure consists of nested DER SEQUENCE, INTEGER, OID, BIT STRING, time, name and extension structures.

DER Public and Private Keys

Cryptographic public and private key formats also frequently use ASN.1 DER. Examples include structures used by PKCS standards and SubjectPublicKeyInfo containers.

This decoder can reveal the underlying DER tree, but cryptographic meaning still depends on the ASN.1 schema and algorithm identifiers surrounding the integer or bit-string values.

Malformed or Non-Canonical DER Detection

Indefinite Length

DER requires definite lengths, so BER indefinite length is rejected.

Non-Minimal Length

A long-form length is rejected when the same length could use a shorter DER representation.

Non-Minimal INTEGER

Redundant leading 00 or FF sign bytes are reported.

Invalid BOOLEAN

DER BOOLEAN must contain exactly one byte and canonical true is FF.

Invalid NULL

ASN.1 NULL must contain zero content bytes.

BIT STRING Padding

Unused-bit count and trailing zero padding are checked.

ASN.1 DER Decoder FAQs

What does DER stand for?

DER stands for Distinguished Encoding Rules.

What is ASN.1 DER?

It is a canonical binary encoding rule set for ASN.1 values and is a restricted form of BER designed to provide deterministic encodings.

What is the difference between BER and DER?

BER permits several encoding choices for some values. DER restricts those choices so the ASN.1 value has one canonical binary representation.

Can DER use indefinite length?

No. DER uses definite-length encoding.

What does DER tag 30 mean?

30 is Universal class, Constructed, tag number 16 — ASN.1 SEQUENCE.

What does ASN.1 tag 02 mean?

Universal tag 2 represents INTEGER.

What does ASN.1 tag 06 mean?

Universal tag 6 represents OBJECT IDENTIFIER.

What does ASN.1 tag 03 mean?

Universal tag 3 represents BIT STRING.

What does ASN.1 tag 04 mean?

Universal tag 4 represents OCTET STRING.

What is a DER OID?

An OBJECT IDENTIFIER is a sequence of numeric arcs encoded using ASN.1 OID content rules and commonly used to identify algorithms and attributes.

How is ASN.1 INTEGER encoded?

INTEGER uses signed two’s-complement content bytes and DER requires the minimal number of bytes necessary to preserve the value and sign.

What is the DER encoding of TRUE?

Canonical DER BOOLEAN true is encoded with content octet FF.

What is the DER encoding of FALSE?

Canonical DER BOOLEAN false uses content octet 00.

What is ASN.1 NULL encoding?

The complete common DER NULL encoding is 05 00.

What is UTCTime in DER?

UTCTime is ASN.1 universal tag 23 and is frequently used for certificate validity dates.

What is GeneralizedTime?

GeneralizedTime is ASN.1 universal tag 24 and supports a four-digit year.

Are X.509 certificates DER encoded?

The binary certificate representation is normally DER. PEM certificates represent those DER bytes in Base64 with textual armor.

Can this decoder validate an entire X.509 certificate?

It can decode its DER structure, but full certificate validation also requires X.509 schema interpretation, signature verification, trust-chain processing and certificate-policy checks.

Can this decoder handle large ASN.1 INTEGER values?

Yes. Exact integer calculations use BigInt rather than JavaScript floating-point Number arithmetic.

Decode ASN.1 DER Binary Structures

Paste DER hexadecimal bytes to inspect ASN.1 tags, lengths, nested containers, integers, object identifiers, strings, bit strings, octet strings and common certificate-related data structures.