SAML Decoder - Decode SAML Assertions & Responses

Decode and analyze SAML tokens, assertions, and responses. View XML structure, attributes, and signature info. Perfect for SSO debugging and integration.

SAML Input

Encoded SAML (Base64)

URL decode first

Inflate (decompress) data

Sample Data

Decoded XML

Paste SAML data and click Decode

SAML Elements Reference

`samlp:Response`	Root element containing status and assertions
`saml:Assertion`	Security statement with subject and attributes
`saml:Subject`	Principal being authenticated (user)
`saml:Conditions`	Validity time constraints
`saml:AttributeStatement`	User attributes (email, name, roles)
`ds:Signature`	XML digital signature for integrity

JWT Generator - Create JSON Web Tokens O…

View all Jwt decoders →

Frequently Asked Questions

SAML (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between identity providers (IdP) and service providers (SP). It's the foundation of enterprise Single Sign-On (SSO).

SAML uses XML and is more verbose, typically used in enterprise SSO with ADFS, Okta, or Azure AD. JWT uses JSON and is compact, commonly used in REST APIs and modern web/mobile apps.

SAML responses are Base64-encoded (not encrypted) for transport. Anyone can decode the XML. The XML signature verifies authenticity. If you need confidentiality, use encrypted SAML assertions.

Assertions are statements about a user: authentication (who logged in, when, how), attributes (email, name, roles), and authorization decisions. They're the core payload of SAML responses.

SAML XML contains special characters that could break HTTP POST/Redirect bindings. Base64 encoding makes it safe for URL parameters and form fields. It's encoding for transport, not security.

Check: Status code (success/failure), Issuer (correct IdP), Subject/NameID (user identifier), NotBefore/NotOnOrAfter (time validity), Audience (correct SP), and attribute values (user info).

This tool shows if a signature element exists but doesn't verify it (requires IdP public key). For verification, use your SP's SAML library. The signature confirms the IdP issued the assertion.

Requests are sent from SP to IdP to initiate authentication. Responses contain assertions from IdP to SP with user information. This tool decodes both, though responses are more common to debug.

Common issues: expired assertions (check NotOnOrAfter), wrong audience (SP entity ID mismatch), clock skew (time sync issues), invalid signature (certificate problems), or missing required attributes.

Yes, all decoding happens in your browser. SAML tokens are typically Base64-encoded XML, and this tool just decodes and formats them locally without sending data anywhere.

SAML Decoder - Decode SAML Assertions & Responses

SAML Input

Sample Data

Extracted Attributes

Decoded XML

SAML Information

SAML Elements Reference

Related Tools