SAML Decoder: Decode & Inspect SAML Responses Online
A SAML decoder takes the opaque base64 blob your identity provider posts to a service provider and turns it back into readable XML. Paste a SAMLResponse value from a POST body, a redirect URL, or raw XML. The tool base64-decodes (and inflates redirect-binding messages), then summarizes what matters for debugging SSO: issuer, status, NameID, audience, validity window, attributes, and whether the message is signed. Everything runs in your browser; the assertion never leaves your machine.
How it works
- 1
Paste the SAMLResponse value (base64, URL-encoded, deflated, or raw XML).
- 2
Click Decode SAML: the tool detects the encoding, decodes it, and parses the XML.
- 3
Read the summary (issuer, NameID, conditions, attributes, signatures) or copy the formatted XML.
Frequently asked questions
How do I decode a SAML response?
Capture the SAMLResponse parameter from the POST to your service provider's ACS URL (browser DevTools → Network tab), paste it above, and click Decode. The value is base64-encoded XML; redirect-binding messages are additionally deflate-compressed, and this tool handles both automatically.
Is it safe to paste a SAML assertion into an online tool?
Assertions contain identity data, so it matters where they go. This decoder runs entirely in your browser with JavaScript, so the assertion is never transmitted, logged, or stored anywhere.
Why is my SAML response failing with Success status?
Common causes visible in the decoded XML: the Audience doesn't match your SP's entity ID, the NotOnOrAfter timestamp has expired (clock skew), the NameID format isn't what your SP expects, or the response is signed at the wrong level (response vs assertion).
What is the difference between a SAML response and an assertion?
The response is the outer protocol envelope carrying the status code; the assertion inside it carries the actual identity claims: subject, conditions, authentication statement, and attributes. A response can contain multiple (or encrypted) assertions.
Can this decrypt an EncryptedAssertion?
No. Encrypted assertions require the service provider's private key. The decoder flags that encryption is present and shows the outer response structure so you can still verify issuer, destination, and status.
Related tools
Validate XML against an XSD schema online. Full W3C XML Schema validation with line-numbered error messages. Free, no signup, results in seconds.
Free XML formatter: beautify, pretty-print, tidy and indent XML online, or minify it to one line. Idempotent formatting, no signup, no upload limit.
Validate XML online: well-formedness check with exact error messages and fixes, document statistics, and namespace report. Free, with nothing uploaded.
Test XPath expressions against XML online. Instant matches with namespace support, functions, and predicates. Free XPath evaluator, no signup.
Format SOAP XML online: requests, responses, and full envelopes. Envelope-aware beautifier with validation. Free, no signup, runs in seconds.