SAML Decoder

What is SAML?

SAML (Security Assertion Markup Language) is an open XML‑based standard for exchanging authentication and authorization data between an Identity Provider (IdP) and a Service Provider (SP), most commonly used to enable Single Sign‑On (SSO) across web applications.

• Identity Provider (IdP): Authenticates users and issues signed SAML assertions.
• Service Provider (SP): Consumes those assertions to grant user access.
• SAML Assertion: An XML document containing authentication statements (who, when), user attributes (e.g., email, roles) and optional authorization decisions.

How to Use this SAML Decoder

• Enter or Load Your SAML Payload
  • Copy/Paste: Pull in from your clipboard
  • Upload: Import a .txt/.xml file
  • Fetch: Load directly from a URL
• Toggle Auto-Update
  • With Auto Update checked, every change you make will immediately re-decode
  • Uncheck it if you’d rather manually trigger decoding.
• Decode
  • If Auto-Update is unchecked, click the central Decode button to run the decoder.
  • The tool will Base64-decode your input and pretty-print the resulting XML.
• Review the Output: Your decoded, formatted XML appears in the Output pane.
  • Copy the XML to your clipboard
  • Download it as an .xml or .txt file

What are the use cases of this SAML Request Decoder?

• Debug SSO issues: Inspect SAML requests to find errors or misconfigurations.
• Test integrations: Validate setup between identity provider (IdP) and service provider (SP).
• Check security: Review signatures, encryption, and authentication contexts.
• View readable XML: Decode base64/XML to see the actual request content.
• Modify & replay: Edit requests for testing different login scenarios.
• Learn & teach: Use in tutorials or training to explain SAML request structure.

Frequently Asked Questions (FAQs)

What does this SAML Decoder do?

It takes a Base64-encoded SAML request or response, decodes it, and pretty-prints the XML so you can easily inspect assertions, attributes, timestamps, and signatures.

Is my SAML data stored on your servers?

No. All decoding happens client-side in your browser. Nothing is sent to or logged on our servers.

Which SAML versions are supported?

Both SAML 1.1 and SAML 2.0 assertions and protocol messages (AuthnRequests, Responses, etc.) are fully supported.

How large of a payload can I decode?

You can paste or upload payloads up to 1 MB in size. For larger files, consider splitting them or using our CLI tool.

What file formats can I upload?

The tool accepts plain text files containing the Base64 payload (e.g., *.txt, *.xml). You can also paste directly into the input box.