SAML Response Decoder
Decode a SAMLResponse or SAMLRequest: Base64, optional DEFLATE inflate, pretty-printed XML and a summary of the key fields.
Base64 → XML 2765 bytes of XML Outside its validity window (expired)
Decoded only: signatures are never verified.
Message summary
- Message type
- Response
- ID
- _8e8dc5f69a98cc4c1ff3427e5ce34606fd672f91e6
- Version
- 2.0
- IssueInstant
- 2024-03-14T09:26:53Z (2024-03-14 09:26:53 UTC)
- Destination
- https://sp.example.com/acs
- InResponseTo
- _4fee3b046395c4e751011e97f8900b5273d56685
- Issuer
- https://idp.example.org/metadata
- Status
- Success (urn:oasis:names:tc:SAML:2.0:status:Success)
- NameID
- jane.doe@example.com
- NameID Format
- urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
- NotBefore
- 2024-03-14T09:26:23Z (2024-03-14 09:26:23 UTC)
- NotOnOrAfter
- 2024-03-14T09:31:53Z (2024-03-14 09:31:53 UTC)
- Audience
- https://sp.example.com/metadata
- AuthnContextClassRef
- urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
- SessionIndex
- _be9967abd904ddcae3c0eb4189adbe3f71e327cf93
- Attribute: email
- jane.doe@example.com
- Attribute: groups
- admins, developers
1 ds:Signature element present (signature rsa-sha256, digest sha256). Not verified: this tool decodes only, it does not check signatures or certificates.
Formatting and samples
How it works
Paste the value of a SAMLResponse or SAMLRequest form field or query
parameter and it is decoded as you type. The tool unwraps the layers a SAML message travels in,
in order: an optional application/x-www-form-urlencoded percent-encoding, then
Base64 (RFC 4648), and then, for the HTTP-Redirect binding described in the OASIS
SAML 2.0 Bindings specification, raw DEFLATE decompression (RFC 1951, done with the
browser's built-in DecompressionStream). Zlib (RFC 1950) and gzip (RFC 1952)
wrappers are recognised too, and raw XML is passed straight through. The resulting XML is
pretty-printed with your chosen indentation, and the badge below the buttons tells you exactly
which chain of decodings was applied.
The summary pulls out the fields you usually need when an SSO login fails: the message type,
ID, IssueInstant, Destination and
InResponseTo, the Issuer, the status code from
samlp:Status, the subject NameID and its format, the
Conditions validity window and Audience, the authentication context,
and every attribute in the AttributeStatement with all of its values, as defined
in OASIS SAML 2.0 Core.
This tool decodes only, it does not verify signatures. It reports whether an
XML Signature (ds:Signature) is present and which algorithms it names, but it does
not canonicalise, digest or check anything against a certificate, so a message shown here may
still be forged. Use your identity provider's metadata and your SAML library for real
validation. Decoding runs entirely in this page with JavaScript: your assertions never leave
your browser, which matters because a real SAMLResponse is a live credential.
Frequently asked questions
How do I decode a SAML response?
Paste the value of the SAMLResponse form field (or the whole redirect query string) into the box and the decoded XML appears next to it as you type. The tool unwraps the layers in the order the SAML 2.0 bindings spec applies them: percent-encoding if present, then Base64, then raw DEFLATE for the HTTP-Redirect binding. A badge tells you exactly which chain was used, and the summary below lists the issuer, status code, NameID, validity window, audience and every attribute.
Why is my SAMLRequest not valid Base64 on its own?
Messages sent over the HTTP-Redirect binding are compressed with raw DEFLATE (RFC 1951, no zlib header) before they are Base64-encoded and percent-encoded into the URL, so decoding the Base64 alone gives you binary rubbish. This tool detects that automatically and inflates it with the browser's built-in DecompressionStream. Zlib and gzip wrappers are recognised too, and plain Base64 from the HTTP-POST binding needs no inflate at all.
Does this tool verify the SAML signature?
No. It decodes and pretty-prints only. It will tell you whether a ds:Signature element is present and which signature and digest algorithms it names, but it does not canonicalise the XML, recompute the digest or check anything against a certificate, so a message shown here can still be forged. Use your identity provider's metadata and your SAML library for real validation. Decoding runs entirely in your browser, so the assertion, which is a live credential, is never uploaded.