SAML Response Decoder
Decode Base64-encoded SAML Responses from SSO flows — extract claims, attributes, and status.
Frequently Asked Questions
Understanding SAML Response Decoding
A SAML Response is the core payload of SAML 2.0 Single Sign-On. After a user authenticates at the Identity Provider, the IdP packages the authentication result into an XML document called a SAML Response, Base64-encodes it, and delivers it to the Service Provider via the user's browser — typically as an HTTP POST form submission.
The SAML Response contains several critical components: a Status block indicating success or failure, one or more Assertions containing the authenticated user's claims, Conditions specifying the validity time window, a Subject with the user's NameID, and AttributeStatements carrying user metadata like email, group memberships, and roles.
When troubleshooting SSO failures, decoding the SAML Response is the first step. Common issues include expired assertions (NotOnOrAfter in the past), mismatched AudienceRestriction values, incorrect NameID formats, or missing required attributes that the SP expects.
This tool handles the full decoding pipeline: URL decoding the raw form value, Base64 decoding the payload, inflating deflate-compressed redirect binding payloads if needed, and parsing the resulting XML into a structured view with all fields clearly labeled.