Skip to content
MtrXTools

SAML decoder

Decode a SAMLRequest or SAMLResponse from a redirect URL or form post (base64 and deflate), pretty-print the XML, and read the issuer, subject, audience, validity window, attributes and signature details. Runs in your browser.

What it decodes

  • A whole HTTP-Redirect URL (?SAMLRequest=... with RelayState, SigAlg and Signature), a form post body (SAMLResponse=...&RelayState=...), the bare parameter value, URL-encoded or not, or the XML itself.
  • The steps are undone in order: URL decoding, base64, and the raw deflate compression the HTTP-Redirect binding adds. Each step is shown, so you can see how the message was carried.
  • The XML is indented for reading, with a copy button.

What the summary shows

  • The message type (AuthnRequest, Response, LogoutRequest, LogoutResponse), ID, issuer, destination and, for requests, the ACS URL, NameID policy and requested authentication context.
  • The status code with sub-status in plain English, such as Requester / InvalidNameIDPolicy or Responder / AuthnFailed.
  • The assertion: NameID and its format, the subject confirmation (Recipient, NotOnOrAfter, InResponseTo), the Conditions validity window with how long ago it expired, the audience, the authentication time, session index and method, and every attribute with its values.
  • Signatures: whether the Response, the Assertion or both are signed, the signature and digest algorithms (SHA-1 is flagged), and the embedded certificate's subject, issuer and expiry, with a copy-as-PEM button.
  • Checks for the usual login failures: an expired assertion, no signature, SHA-1, a Destination that differs from the Recipient, a missing InResponseTo and a status other than Success.

Decoding is not verifying

This tool reads the message; it does not check the XML signature. Only the service provider can verify a response, against the IdP certificate in its own configuration. A certificate embedded in the message proves nothing on its own.

An EncryptedAssertion can only be opened with the SP's private key, so its contents are not shown.

Questions

How do I capture a SAMLResponse?
Open the browser's developer tools, go to the Network tab with "Preserve log" on, and sign in. Find the POST to the service provider's ACS URL and copy the SAMLResponse form field (or the whole request body) into this tool. For a SAMLRequest, copy the URL of the redirect to the IdP.
Why does my SAMLRequest look like garbage after base64 decoding?
With the HTTP-Redirect binding the XML is compressed with raw deflate before base64 and URL encoding. This tool inflates it automatically; a plain base64 decoder shows only compressed bytes.
What does "Assertion expired" mean for a login?
Every assertion is valid for a few minutes (Conditions NotOnOrAfter). If the SP receives it later, or its clock is ahead of the IdP's, it rejects the login. For a capture from earlier, an expired assertion is expected.
Is my SAML response sent anywhere?
No. Decoding runs in your browser, and nothing is uploaded or saved. SAML responses contain personal data such as names, email addresses and group memberships, so treat them with care.

Related tools