Decode SAML

Inspect the claims and conditions inside a SAML assertion.

freeworks offlinenothing uploaded
ToolSAML Decoder
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

The Base64-encoded XML assertion or protocol message is decoded and parsed into issuer, subject, conditions, attributes, and signatures. XML parsing exposes claims but does not establish signature trust, audience acceptance, or replay protection.

  • SAML bindings carry XML assertions through different transport encodings.

Worked example

Decode SAML 2.0 Response with NameID assertion
Decode a Base64-encoded SAML response containing a user identity assertion
Input
											PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIElEPSJfYWJjMTIzIj48c2FtbDpBc3NlcnRpb24geG1sbnM6c2FtbD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+PHNhbWw6U3ViamVjdD48c2FtbDpOYW1lSUQ+dXNlckBleGFtcGxlLmNvbTwvc2FtbDpOYW1lSUQ+PC9zYW1sOlN1YmplY3Q+PC9zYW1sOkFzc2VydGlvbj48L3NhbWxwOlJlc3BvbnNlPg==
Output
												<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="_abc123">
  <saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
    <saml:Subject>
      <saml:NameID>[email protected]</saml:NameID>
    </saml:Subject>
  </saml:Assertion>
</samlp:Response>

When to use this

Identity-provider responses, service-provider diagnostics, and assertion timestamp reviews inspect SAML.

Edge cases

  • A valid XML signature can still target another audience.
  • Clock skew can make NotBefore or NotOnOrAfter appear invalid.
  • XML entity expansion must not be enabled for untrusted input.

References