SAML Response Decoder
Base64-decode and inflate a SAML response to read the underlying XML assertion.
Output appears here as you type — decoded on your device.
Input is processed on your device. Nothing you paste is sent anywhere.
What is the SAML Response Decoder?
A SAML decoder Base64-decodes (and, for redirect binding, inflates) a SAMLRequest or SAMLResponse parameter to reveal the XML assertion an identity provider issued about a user.
SAML 2.0 is the XML-based single sign-on protocol behind most enterprise logins. When an identity provider authenticates a user it sends an assertion to the service provider, encoded so it can ride in an HTTP form field or query string. HTTP-POST binding uses plain Base64; HTTP-Redirect binding uses raw DEFLATE compression before the Base64, which is why a redirect SAMLRequest looks like binary noise when you decode it naively.
Inside the XML are the parts that matter when SSO breaks: the Issuer, the Subject NameID identifying the user, the Conditions block with NotBefore/NotOnOrAfter windows and AudienceRestriction, the AttributeStatement carrying group and email claims, and the Signature. Most SSO failures come down to a clock skew, an audience mismatch or a missing attribute — all visible once the assertion is readable.
SAML Response Decoder at a glance
- Standard
- SAML 2.0 (OASIS)
- POST binding
- Base64 only
- Redirect binding
- raw DEFLATE, then Base64, then URL-encoded
- Key elements
- Issuer, Subject, Conditions, AttributeStatement
How to use the SAML Response Decoder
- 1Copy the SAMLResponse or SAMLRequest value from the form post or the query string.
- 2Paste it in — URL-encoding, Base64 and DEFLATE are unwrapped automatically.
- 3Read the XML: check Issuer, Audience, the NotOnOrAfter window and the attributes.
When you would reach for it
- Diagnosing a failed enterprise SSO login against Okta, Entra ID or Ping.
- Confirming which attributes and NameID format an IdP is actually sending.
- Checking assertion validity windows when logins fail intermittently.
SAML Response Decoder — frequently asked questions
Last reviewed · questions or corrections: contact@decoder.tools