SAML Decoder: Decode SAMLResponse and SAMLRequest XML

Q: Why can't I read the assertion after decoding?

The assertion is probably an . Only the service provider's private key can decrypt it. Decoding shows the envelope, the issuer and the status, but not the attributes.

A SAML decoder turns the encoded SAMLResponse or SAMLRequest parameter from a single sign-on flow back into its XML, so you can read the issuer, status, subject and attributes.

Example

A SAMLResponse from the HTTP-POST binding (shortened to a minimal response):

Input

PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIElEPSJfOGU4ZGM1ZjY5YTk4Y2M0YyIgVmVyc2lvbj0iMi4wIiBJc3N1ZUluc3RhbnQ9IjIwMjYtMTAtMjNUMDk6MDA6MDBaIj48c2FtbDpJc3N1ZXIgeG1sbnM6c2FtbD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+aHR0cHM6Ly9pZHAuZXhhbXBsZS5jb208L3NhbWw6SXNzdWVyPjxzYW1scDpTdGF0dXM+PHNhbWxwOlN0YXR1c0NvZGUgVmFsdWU9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpzdGF0dXM6U3VjY2VzcyIvPjwvc2FtbHA6U3RhdHVzPjwvc2FtbHA6UmVzcG9uc2U+

Output

<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="_8e8dc5f69a98cc4c" Version="2.0" IssueInstant="2026-10-23T09:00:00Z"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://idp.example.com</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status></samlp:Response>

The same XML sent through the HTTP-Redirect binding is deflated first. Paste that version and the decoder inflates it automatically.

How SAML messages are encoded

SAML 2.0 messages are XML, but they travel through the browser, so they are encoded according to the binding:

HTTP-POST binding. The XML is Base64-encoded and placed in a hidden form field named SAMLResponse (or SAMLRequest). This is how identity providers usually return assertions.
HTTP-Redirect binding. The XML is compressed with raw DEFLATE, then Base64-encoded, then URL-encoded into a query parameter. Service providers usually send AuthnRequest messages this way.

This tool Base64-decodes the input and, if the result isn't XML, tries raw DEFLATE. If you copied the value straight from a URL, run it through the URL decoder first so %2B and %3D become + and =.

Where to find the SAMLResponse

Browser dev tools. Open the Network tab, enable "Preserve log", sign in, and find the POST to the service provider's ACS URL. The SAMLResponse value is in the form data.
Redirect URLs. SAMLRequest=… appears in the query string of the redirect to the identity provider.
SP logs. Many service providers can log the raw response in debug mode.

What to check in a decoded response

Element	What to look for
`<saml:Issuer>`	The identity provider's entity ID, which must match your configuration
`<samlp:StatusCode>`	`…:status:Success`. Anything else explains a failed login
`<saml:NameID>`	The user identifier and its format
`<saml:Conditions>`	`NotBefore` / `NotOnOrAfter` window and `AudienceRestriction`
`<saml:AttributeStatement>`	The attributes (email, groups, roles) being sent
`<ds:Signature>`	Whether the response or the assertion is signed
`<saml:EncryptedAssertion>`	The assertion is encrypted and can only be read with the SP's private key

How to use the SAML decoder

Paste the SAMLResponse or SAMLRequest value.
Read the XML. Deflated redirect-binding messages are inflated automatically.
Check the status, issuer, audience and time conditions against your configuration.

Decode SAML in code

Python

import base64, zlib

saml_response = "PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIElEPSJfOGU4ZGM1ZjY5YTk4Y2M0YyIgVmVyc2lvbj0iMi4wIiBJc3N1ZUluc3RhbnQ9IjIwMjYtMTAtMjNUMDk6MDA6MDBaIj48c2FtbDpJc3N1ZXIgeG1sbnM6c2FtbD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+aHR0cHM6Ly9pZHAuZXhhbXBsZS5jb208L3NhbWw6SXNzdWVyPjxzYW1scDpTdGF0dXM+PHNhbWxwOlN0YXR1c0NvZGUgVmFsdWU9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpzdGF0dXM6U3VjY2VzcyIvPjwvc2FtbHA6U3RhdHVzPjwvc2FtbHA6UmVzcG9uc2U+"
print(base64.b64decode(saml_response).decode()[:60])

# Redirect binding: raw DEFLATE (wbits=-15) after Base64
saml_request = "fZBNa8MwDIb/SvC9sZe1JRFJYGyXQndZRg+7DOFoLOAvLBv68+ulh7WXgi56eXgfoZ7RmgAfxME7pupsjWNYw0Hk6MAjLwwOLTEkDdPL+xGaWkGIPnntjagOb4P4bqmd9e5n32HXar3VojpR5MW7QRS6QMyZDo4TulQi1ew3T2rTPH+qDpQq8yXG/k8LKxlvDnl8BzJTTEUkxt+UAoOUyxxqOqMNhmrtbS9veq+SAFPClPl+e/UzVSc0mR4reaVhyloTs5Dj1fBfKu+fOl4A"
print(zlib.decompress(base64.b64decode(saml_request), -15).decode()[:60])

SAML at a glance

Specification	OASIS SAML 2.0 (core and bindings)
POST binding	Base64 XML in a form field
Redirect binding	Raw DEFLATE, then Base64, then URL-encoding
Timestamps	ISO 8601 in UTC, for example `2026-10-23T09:00:00Z`

Frequently asked questions

Why can't I read the assertion after decoding?

The assertion is probably an <EncryptedAssertion>. Only the service provider's private key can decrypt it. Decoding shows the envelope, the issuer and the status, but not the attributes.

Why does the login fail with "Response is not yet valid" or "expired"?

The clocks of the identity provider and the service provider are out of sync, or the response was replayed later. Compare NotBefore and NotOnOrAfter in <Conditions> with the current UTC time. Most SPs allow a few minutes of clock skew.

Does decoding check the signature?

No. Signature validation needs the identity provider's certificate and XML canonicalization. This tool only decodes the message so you can read it.

Last reviewed 23 October 2026 · found a mistake? contact@decoder.tools · view as markdown