ES
Home › Developer Tools › SAML Decoder

SAML Decoder

Paste a SAMLResponse, SAMLRequest, a redirect URL or a POST body. The decoder works out the encoding (URL-encoded, base64, DEFLATE), shows the formatted XML and pulls out the user, attributes, audience, signatures and every validity time, checked against your clock. Nothing leaves your browser.

Last updated:

Advertisement
Advertisement

How to use the SAML Decoder

  1. Copy the SAML message from your browser's developer tools (Network tab, the POST to the ACS URL or the redirect to the IdP) or from a SAML tracer extension.
  2. Paste it into the box: just the value, the whole URL, or the form body all work.
  3. Read the summary to see who issued it, which user it is for, the status and the attributes.
  4. Check the validity times; set the clock skew your service provider allows if timing errors are the problem.
  5. Copy the XML or switch to Encode to turn edited XML back into a SAMLRequest or SAMLResponse for testing.

How SAML messages are encoded

BindingTypical messagesEncoding stepsWhere you find it
HTTP-RedirectAuthnRequest, LogoutRequest, LogoutResponseXML → raw DEFLATE → base64 → URL-encodeQuery string: ?SAMLRequest=…&RelayState=…&SigAlg=…&Signature=…
HTTP-POSTResponse (with assertion), sometimes AuthnRequestXML → base64 (form posts URL-encode it)Hidden form field SAMLResponse posted to the ACS URL
HTTP-ArtifactArtifact, then ArtifactResolve / ArtifactResponseShort artifact reference; the XML is fetched over a back channelSAMLart parameter

A decoded POST message starts with <samlp:Response or <saml2p:Response; base64 of XML almost always begins with PH (the encoding of <). Deflated redirect messages usually begin with fZ, nZ, jZ or similar.

What to check when SAML login fails

SymptomField to look atCommon cause
"Assertion expired" or "not yet valid"Conditions NotBefore / NotOnOrAfter, SubjectConfirmationData NotOnOrAfterServer clock drift; a replayed old response; skew allowance too small
"Audience invalid"AudienceRestriction / AudienceSP entity ID in the IdP config differs from the SP's own entity ID (trailing slash, http vs https)
"Invalid destination" or "recipient"Response Destination, SubjectConfirmationData RecipientACS URL configured differently at the IdP and SP, or a proxy changes the host
"InResponseTo mismatch"InResponseToIdP-initiated login sent to an SP expecting SP-initiated, or the SP lost the request ID (session cookie dropped)
"Signature invalid"Signature, certificate fingerprintThe IdP rotated its signing certificate; the SP expects the assertion signed but only the response is (or vice versa)
User not found or wrong userNameID and format, attributesWrong NameID format (persistent vs email), attribute names not mapped

Common SAML status codes

  • urn:oasis:names:tc:SAML:2.0:status:Success: the request succeeded.
  • …:status:Requester: the request was wrong; look at the second-level code.
  • …:status:Responder: the identity provider had a problem.
  • …:status:AuthnFailed: the user could not be authenticated.
  • …:status:InvalidNameIDPolicy: the requested NameID format is not available.
  • …:status:NoPassive: IsPassive was requested but the user must interact to log in.
  • …:status:RequestDenied: the IdP refuses to answer, often because the user is not assigned to the app.

Frequently asked questions

How is a SAMLResponse encoded?

With the HTTP-POST binding the XML is base64-encoded and sent as the SAMLResponse form field, so it often appears URL-encoded in the request body (%2B for +, %3D for =). With the HTTP-Redirect binding, used mostly for AuthnRequests and logout messages, the XML is first compressed with raw DEFLATE, then base64-encoded and URL-encoded into the query string.

Why does base64 decoding a SAMLRequest give unreadable characters?

Because Redirect-binding messages are compressed with DEFLATE before base64 encoding. The decoded bytes must be inflated (raw DEFLATE, RFC 1951) to get the XML. This tool detects that and inflates automatically.

Is it safe to paste a real SAML response here?

The decoding runs entirely in your browser and nothing is sent to a server. Still treat SAML responses like passwords: a bearer assertion that has not expired can be replayed to log in as that user. Prefer test accounts or expired messages when sharing with others.

Does this tool verify the XML signature?

No. It shows what is signed (the Response, the Assertion or both), which algorithms are used and the certificate fingerprint, so you can compare it with the certificate in your IdP metadata. Real signature validation must be done by your service provider's SAML library with the trusted certificate.

What do NotBefore and NotOnOrAfter mean?

They define the time window in which the assertion may be accepted. Conditions NotBefore/NotOnOrAfter limit the whole assertion; SubjectConfirmationData NotOnOrAfter limits how long the bearer confirmation can be used, typically a few minutes. If the IdP and SP clocks differ, valid logins can fail; most libraries allow a small clock skew such as 1 to 5 minutes.

Why is my assertion shown as encrypted?

Some identity providers encrypt the assertion with the service provider's public key (EncryptedAssertion). Only the SP's private key can decrypt it, so the decoder can show the outer Response and status but not the user or attributes inside.

What does an InvalidNameIDPolicy or Requester status mean?

The status code tells you why login failed. Requester means the request from the SP was at fault; a second-level code such as InvalidNameIDPolicy means the requested NameID format is not supported for that app, and AuthnFailed means the user did not authenticate. Fix the SP request or IdP configuration and try again.

Are all the tools on FreeToolCabin tested for quality and accuracy?

Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.

Related tools

JWT DecoderDecode JSON Web Tokens, read the claims and expiry, and verify HS256 signatures.SSL Certificate DecoderDecode PEM SSL/X.509 certificates: subject, issuer, expiry, SANs, key and fingerprints.XML FormatterBeautify, validate and minify XML with a collapsible tree view.Base64 Encoder DecoderEncode or decode Base64 text and files, and make data URIs.Password GeneratorCreate strong passwords and passphrases.Hash GeneratorGenerate MD5, SHA-1, SHA-256 and SHA-512 hashes of text or files.MD5 Hash GeneratorGenerate MD5 hashes of text, lines or files and verify checksums.SHA-256 Hash GeneratorSHA-256 and HMAC-SHA256 hashes of text, lines or files, in hex or Base64.URL Encoder DecoderPercent-encode or decode URLs, query strings and form data.HTML Entity Encoder / DecoderEscape and unescape HTML entities, named or numeric.Bcrypt Hash Generator & CheckerCreate bcrypt password hashes and check a password against a hash.Binary TranslatorConvert text to binary, hex, octal and back.HMAC GeneratorGenerate and verify HMAC signatures with SHA-256, SHA-512, SHA-1 or MD5.CRC32 Checksum CalculatorCalculate CRC-32, CRC-32C, CRC-16 and Adler-32 checksums of text or large files.JWT GeneratorCreate and sign HS256, HS384 or HS512 JSON Web Tokens in your browser and verify them.Password Strength CheckerSee how strong a password really is, how long it takes to crack and how to improve it.Caesar CipherEncode and decode Caesar shift ciphers and crack unknown shifts with a ranked brute force.Vigenère CipherEncrypt and decrypt Vigenère and Autokey ciphers, and crack unknown keys with frequency analysis.Atbash CipherEncode and decode Atbash ciphers (A↔Z, B↔Y) in Latin or Hebrew, with a live letter mapping table.ASCII TableFull ASCII code chart 0–255 in decimal, hex, octal, binary and HTML, with search and copy.Unicode Character LookupFind Unicode characters by name or code point and copy them with UTF-8, HTML and code escapes.Punycode ConverterConvert international domain names, emails and URLs between Unicode and xn-- Punycode, in bulk.JSON Escape / UnescapeEscape text for a JSON string, unescape \n and \" back to text, or stringify a whole object.Binary to HexConvert binary to hex instantly with steps and signed mode.Hex to BinaryConvert hex to binary instantly with steps and signed mode.Binary CalculatorAdd, subtract, multiply, divide, AND, OR, XOR and shift binary numbers with decimal values.Hex CalculatorHexadecimal + − × ÷ and AND, OR, XOR, NOT, shifts with decimal and binary equivalents.Base32 Encoder / DecoderEncode and decode Base32 (RFC 4648), Base32hex, Crockford and z-base-32 from text, hex or files.Base58 Encoder / DecoderEncode and decode Base58 and Base58Check (Bitcoin alphabet) from text or hex, with checksum verification.Unicode Escape / UnescapeConvert text to \uXXXX, \u{...}, \x, &#...; or CSS escapes and decode them back.File Hash CheckerGet MD5, SHA-1, SHA-256 and SHA-512 checksums of files and verify them against a hash.TOTP GeneratorGenerate 2FA one-time codes from a secret key, create otpauth QR codes and verify codes.RSA Key GeneratorGenerate 2048, 3072 or 4096-bit RSA key pairs as PEM, PKCS#1, JWK or OpenSSH, locally.Text Encryption ToolEncrypt and decrypt text with a password using AES-256-GCM, entirely in your browser.Argon2 Hash GeneratorHash passwords with Argon2id, Argon2i or Argon2d and verify them against an encoded hash.Base64 to PDFDecode a Base64 string to a PDF with preview and download, or encode a PDF to Base64.Bitwise CalculatorCalculate AND, OR, XOR, NOT and bit shifts at 8–64 bits with a bit grid and all bases.CSR GeneratorCreate a certificate signing request (CSR) and private key with SANs, RSA or ECDSA, in your browser.PBKDF2 Hash GeneratorDerive PBKDF2 keys from a password, salt and iteration count with SHA-1, SHA-256 or SHA-512.Protobuf DecoderDecode raw Protocol Buffers hex or Base64 without a schema, or add a .proto for field names.XML Escape / UnescapeEscape & < > " ' for XML text and attributes, unescape entities back, or wrap text in CDATA.Binary Search Tree VisualizerInsert, delete and find in BST, AVL and red-black trees with animated rotations and traversals.MongoDB ObjectId to TimestampDecode a MongoDB ObjectId to its creation date, or build ObjectIds from dates for range queries.PGP Encrypt / DecryptEncrypt, decrypt, sign and verify PGP messages with your armored keys, entirely offline.PGP Key GeneratorGenerate an OpenPGP key pair (Curve25519, NIST ECC or RSA) with passphrase and expiry, offline.Quoted-Printable Encoder / DecoderEncode or decode quoted-printable email text (MIME) with UTF-8 and 76-character soft line breaks.Self-Signed Certificate GeneratorCreate a self-signed SSL certificate and key for localhost or dev servers, as PEM or PFX.SHA-1 Hash GeneratorSHA-1 and HMAC-SHA1 of text or files in hex or Base64, plus Git blob hashes and verify.SHA-512 Hash GeneratorSHA-512 and SHA-384 hashes of text or files in hex or Base64, HMAC and hash verification.SRI Hash GeneratorCreate Subresource Integrity hashes (sha256/384/512) and ready <script> or <link> tags.SSH Key GeneratorGenerate Ed25519 or RSA SSH key pairs in your browser: OpenSSH public key plus private key.String Escape / UnescapeEscape or unescape strings for JavaScript, Java, C#, Python, C, SQL, regex, CSV and shell.UTF-8 Encoder / DecoderConvert text to UTF-8 bytes in hex, decimal, binary, \x or % and decode bytes back to text.UUID Decoder & ValidatorDecode any UUID: version, variant, v1/v6/v7 timestamp and MAC node, plus bulk validation.Base64 to FileDecode Base64 or a data URI to a downloadable file; detects the real file type and previews it.File Encryption ToolEncrypt and decrypt any file with a password using AES-256-GCM, entirely in your browser.Passphrase GeneratorMake strong, memorable diceware passphrases from a 7,776-word list, with entropy in bits.CSR DecoderDecode a PEM certificate signing request: subject, SANs, key size, signature and CA readiness checks.Enigma Machine SimulatorEncrypt and decrypt with a virtual Enigma I, M3 or M4: rotors, rings, plugboard and lampboard.Hex Opacity CalculatorConvert opacity percent to a 2-digit HEX alpha code and full #RRGGBBAA color, with a 0-100% table.Playfair CipherEncrypt and decrypt Playfair ciphers from a keyword, with the 5x5 key square and every digraph step.Pwned Password CheckerCheck if a password appeared in data breaches; only 5 characters of its SHA-1 hash are sent.RSA Encryption ToolEncrypt text with an RSA public key and decrypt it with the private key using RSA-OAEP in your browser.SSL Certificate ConverterConvert SSL certificates and keys between PEM, DER, PFX/P12 and P7B in your browser.Checksum CalculatorCompute 8-bit sum, two's complement LRC, XOR/BCC, NMEA, Fletcher and Internet checksums of bytes.
See all 65 Encoders, Hashes & Crypto →