SAML Decoder
Decode SAMLRequest and SAMLResponse from POST, Redirect or raw XML
SAML input
Paste XML, base64, a SAMLRequest or SAMLResponse value, a redirect URL or a form body.
Summary
Raw XML
Related Tools
What the decoder does
SAML Decoder turns a SAMLRequest or SAMLResponse into readable XML and a structured summary. It detects the transport encoding for you: raw XML, base64 from the HTTP-POST binding, raw DEFLATE plus base64 from the HTTP-Redirect binding, URL-encoded values, full redirect URLs, form bodies and auto-submit HTML forms. Each step is listed, so you can see exactly how the message was decoded.
What you can inspect
The Overview shows the message type, ID, issuer, destination, issue instant, InResponseTo, the status code with any nested code and message, and which parts are signed. The Assertion tab shows each assertion separately: subject NameID, subject confirmation, audience, validity window, authentication instant, session index and session expiry. The Attributes tab lists every attribute with its FriendlyName, NameFormat and all of its values. Requests show the ACS URL, protocol binding, NameID policy and requested authentication context.
Limits
Signatures are reported by presence, algorithm and reference only; they are not cryptographically verified, so a decoded message is not proof of authenticity. Encrypted assertions cannot be decrypted because that needs the service provider private key. DOCTYPE and ENTITY declarations are rejected. Inputs up to 1 MB are accepted, and inflated messages are capped at 2 MB. SAML 1.x is not supported. To check timestamps, audience and recipient against your configuration, use the SAML Response Validator.
Privacy
Decoding runs entirely in your browser. SAML messages are not uploaded, stored, logged or added to the URL, and links to related tools never carry the message.
