SAML Decoder
Decode SAML requests and responses from Base64 or HTTP-Redirect payloads
Issuer, audience, ACS, validity, and formatted XML will appear here.
About this tool
SAML Decoder accepts a Base64 SAML message, a SAMLRequest or SAMLResponse query parameter, or a complete HTTP-Redirect URL. It detects plain POST-binding Base64 and raw-DEFLATE redirect payloads, formats the decoded XML, and summarizes the root message, Issuer, Destination or Assertion Consumer Service, Audience, NameID, Conditions validity window, and whether an XML Signature element is present. The tool runs locally and does not contact an identity provider. It is a protocol inspection aid, not a signature, trust-chain, replay, or authorization validator.
Scenario Recipes
Triage an identity-provider redirect failure
Goal: Confirm the binding and protocol fields before changing SSO configuration
- Paste the complete callback URL or captured SAML parameter.
- Confirm message type, Issuer, Destination, Audience, and validity window.
- If those fields match, continue with signature, certificate, clock, replay, and account-mapping checks in the trusted service provider.
Result: A readable SAML XML sample and focused checklist for the next SSO investigation step.
Frequently Asked Questions
Which SAML inputs can the decoder read?
It accepts raw Base64, SAMLRequest or SAMLResponse parameters, and full redirect URLs containing either parameter.
Does it support HTTP-Redirect DEFLATE encoding?
Yes. When Base64 does not decode directly to XML, the tool attempts raw DEFLATE as defined by the SAML HTTP-Redirect binding.
Can the decoder verify the XML signature?
No. It reports whether a Signature element exists but does not validate canonicalization, certificate trust, signature value, or reference digests.
Why can a decoded SAML response still fail login?
The service provider may reject its signature, audience, destination, recipient, time window, InResponseTo value, replay state, or account mapping.
Are encrypted SAML assertions decrypted?
No. EncryptedAssertion content requires the service provider private key and must be decrypted inside a trusted identity integration.
Is the SAML payload uploaded or stored?
No. Base64 decoding, DEFLATE expansion, XML parsing, and summary extraction happen entirely in your browser.
Keep browsing