Free Online SAML Decoder
This SAML Decoder quickly turns encoded responses and authentication requests into readable XML right in your browser. Since SSO systems often exchange tokens in complex Base64 or DEFLATE formats, reading them manually is nearly impossible. The tool handles the heavy lifting by detecting encoding layers and stripping them away to show you a clean, indented view. Just paste your SAMLResponse, upload a file, or drag and drop it into the workspace to get started. You can decode, encode, inspect, and validate all in one place.
SAML Decoder
Quickly decode Base64 and DEFLATE-compressed SAML data into formatted XML with automatic detection.
SAML Encoder
Easily encode SAML XML into Base64 with optional compression and URL encoding for any binding.
SAML Inspector
Instantly view Issuer, NameID, attributes, and security conditions in a structured table.
SAML Validator
Check XML structure and SAML conditions while receiving clear reports on errors and warnings.
Online SAML Decoder for SSO Debugging and Integration Testing
Effective debugging of SAML flows starts with reading the actual XML exchanged between identity and service providers. While browser developer tools usually show these as opaque Base64 strings, pasting them here reveals the complete XML structure. You can instantly see assertion details, attribute statements, and signature references. The decoder automatically handles plain Base64, DEFLATE combinations, and URL-encoded variants without any manual configuration.
Automatic Encoding Detection
Stop guessing which decoding steps you need and let the tool figure it out for you. It automatically attempts URL decoding followed by Base64 and DEFLATE decompression to ensure the best results. A method badge in the output header shows you exactly which path was taken, giving you better insight into how your message was originally encoded.
File Upload Support
You can click the Upload button or simply drag and drop your .xml or .saml files directly into the input panel for instant processing. Even the largest SAML responses with embedded certificates are handled smoothly without any file size restrictions. Because everything runs locally, your data stays private and the processing remains fast.
Inspect SAML Assertions, Attributes, and Security Details
Scanning raw SAML XML for a NameID or a specific attribute value can be time-consuming. The SAML Inspector streamlines this by pulling every critical field into an easy-to-read table. You can quickly review the Issuer, StatusCode, session index, and time conditions at a glance. Detailed attribute statements and signature metadata are also organized into collapsible sections for better visibility.
SAML Attribute Extraction
Identity providers typically include user roles, emails, and group memberships within the SAML assertion. The inspector extracts these elements into a clean grid, showing multi-valued attributes as simple, comma-separated lists. This helps you verify that your IdP is sending the correct claims without having to manually scan through lines of XML.
Conditions and Time Validation
Every SAML assertion has a validity window defined by NotBefore and NotOnOrAfter timestamps. The validator automatically checks these against your current time and flags any expired or premature assertions. It also extracts audience restrictions, allowing you to confirm the token was actually meant for your specific service provider.
Encode and Validate SAML Messages
This workspace goes beyond simple decoding by offering tools to construct and validate SAML messages. Use the encoder to apply DEFLATE, Base64, and URL encoding for your specific binding needs. The validator ensures your XML is well-formed, checks namespaces, and identifies missing required elements like the Issuer or StatusCode. All results are presented with clear, color-coded indicators for errors and warnings.
Client-Side Security
Security is critical because SAML tokens often contain sensitive user IDs and session data. Every operation performed here stays within your browser, utilizing local APIs for processing. Your data is never sent over the network, no cookies are tracked, and nothing is ever stored on our end. Once you close the tab, all your data is gone.
Related Security and Developer Tools
If you work with authentication and encoded data regularly, these tools complement the SAML decoder:
- Base64 Encoder/Decoder -- encode and decode Base64 strings for any data format
- XML Formatter -- format, indent, and beautify XML documents
- XML Validator -- validate XML syntax and structure
- JWT Decoder -- decode and inspect JSON Web Tokens
- URL Encoder/Decoder -- encode and decode URL-safe strings
- JSON Formatter -- format, minify, validate, and transform JSON data