SAML Decoder
Decode a SAMLRequest or SAMLResponse and see the issuer, user, conditions and attributes.
Runs in your browser Your input never leaves your device.
Decoded in your browser; nothing is sent. This tool reads the message. It does not check signatures or decrypt anything, so a message that looks fine here may still be rejected, or forged. Do not use real production assertions you are not allowed to share, as they can contain personal data and may still be replayable until they expire.
Report a problem with this tool
About this tool
SAML single sign-on sends XML messages between an identity provider and a service provider, usually inside a browser: base64 in a form field for the POST binding, or deflated, base64 and URL-encoded in a query parameter for the redirect binding. When login fails it helps to see what was actually sent. Paste the whole URL, the form fields, only the encoded value, or raw XML, and this tool finds the message, inflates it when needed and reads it: the type (Response, AuthnRequest, LogoutRequest), issuer, destination, the status, and for each assertion the user (NameID and its format), the validity window, the intended audience, the session, the authentication method and every attribute. Findings point out common causes of failed logins: an expired or not-yet-valid assertion (with a few minutes of clock skew allowed), a missing audience restriction, unsigned assertions, weak SHA-1 signatures, a failure status, and encrypted assertions that only the service provider can open. The signing certificate in the message is shown with its name and expiry. This tool does not verify signatures and does not decrypt: it explains what the message says, which is not the same as proving it is genuine. For safety it refuses XML with a DOCTYPE or ENTITY declaration and stops decompression of oversized data. Everything runs in your browser.
How to use it
- Copy the SAMLResponse or SAMLRequest from your browser developer tools, a log or a proxy. A whole URL or the form text is fine.
- Paste it. The message is decoded as you type.
- Read the findings first, then the assertion and attribute tables.
- Open Formatted XML to see the exact message, for example to compare an attribute name with your configuration.
Common problems
- It says the data is neither XML nor deflate-compressed XML
- The value may be cut off or double-encoded. Copy the full parameter value, and if it came from a URL make sure none of it is missing.
- The conditions say expired but the login just happened
- Compare the clocks of the identity provider and the service provider. Assertions are usually valid for only a few minutes, so a skewed clock makes them look expired.
- Why can I not see the attributes?
- They may be inside an encrypted assertion, which only the service provider can decrypt. Ask the identity provider to send an unencrypted copy for debugging in a test setup.