SAML Decoder & Debugger
Decode SAML responses and requests — view formatted XML, extract claims, validate timestamps, and inspect signatures.
About this tool
This tool decodes SAML (Security Assertion Markup Language) messages — paste a SAMLResponse or SAMLRequest from HTTP-Redirect (deflated + base64 + URL-encoded) or HTTP-POST (base64-encoded) bindings and get the decoded XML with extracted claims.
It shows the issuer, NameID, subject confirmation data with time validation against your system clock, conditions (NotBefore / NotOnOrAfter), attribute statements with all attribute names and values, authentication context, and signature details including algorithm and X.509 certificate information. SHA-1 signatures are flagged with a warning since they are considered weak.
Example: paste a SAML Response from an Okta or Azure AD login flow and you'll see the user's email as NameID, their group memberships as attributes, and whether the assertion is still within its validity window. The signature algorithm badge confirms whether the IdP used SHA-256 (safe) or SHA-1 (warning).
FAQ
What SAML bindings does this tool support? ›
HTTP-Redirect (deflated → base64 → URL-encoded) and HTTP-POST (base64-encoded). It auto-detects the encoding — if the input starts with <code><</code> it treats it as raw XML; otherwise it URL-decodes, base64-decodes, and attempts inflation.
Does this tool validate XML signatures? ›
It inspects the <code>ds:Signature</code> block, showing the signature algorithm, digest algorithm, and X.509 certificate. It flags SHA-1 as weak. Full cryptographic signature validation against the certificate would require X.509 chain verification (not possible in a browser tool), but the displayed information lets you assess the signature method at a glance.
How does the time validation work? ›
<code>NotBefore</code> and <code>NotOnOrAfter</code> conditions are compared against your system clock. If expiration has passed, the tool shows <strong>EXPIRED</strong>. If within 5 minutes of expiry it shows <strong>EXPIRING SOON</strong>. Otherwise <strong>VALID</strong>. This is a local check — the IdP and SP clocks may differ.
What are the most common SAML attributes decoded? ›
Common attributes include <code>mail</code> (email), <code>givenName</code> / <code>sn</code> (first/last name), <code>memberOf</code> (groups), <code>uid</code> (user ID), and <code>displayName</code>. Each IdP (Okta, Azure AD, Google Workspace) uses slightly different attribute names — the tool shows whatever the IdP sent.
Does this tool ever send my SAML data over the network? ›
No. All decoding, inflation, XML parsing, and time validation happens in your browser.
How do I capture a SAML message from my browser? ›
Use the SAML-tracer browser extension, or open DevTools → Network tab, find the POST to your ACS URL, and copy the <code>SAMLResponse</code> form parameter. For HTTP-Redirect bindings, copy the full query string parameter from the address bar.