SAML Response Decoder

Decode SAMLResponse payloads from SSO traces

After an identity provider authenticates a user, the browser or your app receives a SAMLResponse-often as a Base64 field in an HTTP POST body or as a redirect query parameter. Redirect binding wraps DEFLATE-compressed XML; POST binding is usually plain Base64 XML.

Paste the raw parameter value to recover XML and read protocol fields: response Status, InResponseTo, assertion issuer, subject NameID, audience restrictions, and condition windows. For deeper assertion attribute review, open the SAML Assertion Inspector. To decode outbound SAMLRequest values, use the SAML Request Decoder.

Typical troubleshooting workflow

1. Copy SAMLResponse from a browser network tab, proxy, or IdP test harness.
2. Decode to XML and confirm StatusCode is Success.
3. Match Audience and NotOnOrAfter against your service provider metadata.
4. Validate signatures and trust separately, this tool does not verify cryptography.