← ALL TOOLS
// ENCODING · BROWSER

SAML Decoder

Decode a SAMLRequest or SAMLResponse (Redirect or POST binding), pretty-print the XML and review issuer, audience, conditions and signatures.

ENCODING · IN YOUR BROWSER

Runs in your browser; nothing you type leaves this page. Too long to share as a link.

HISTORY

Your last 5 runs appear here for 7 days, on this device only.

RESULT

Fill in the form and run the tool; the result appears here.

SAML Decoder turns an encoded SAML message back into readable XML and lists the fields that matter when you troubleshoot or test single sign-on. Paste a SAMLResponse from the POST binding, a SAMLRequest from the Redirect binding (compressed), the full login URL, or the XML itself. It shows the issuer, NameID, audience, validity window, attributes and the signature algorithms, and flags common weaknesses.

How to read the result

Encoding tells you how the message travelled: HTTP-POST messages are only Base64, HTTP-Redirect messages are compressed with DEFLATE first. The pairs cover the protocol message (Response, AuthnRequest and so on), its ID and destination, the status, the subject's NameID and format, the audience and the NotBefore and NotOnOrAfter conditions, compared with your clock. The attributes table lists what the identity provider asserts about the user. The full XML is pretty-printed at the end.

The findings flag SHA-1 signatures or digests, an unsigned response, an assertion that is not signed on its own, expired conditions, a DOCTYPE and XML comments. Signatures are reported but not validated.

Defender tips

  • Ask your identity provider to sign with SHA-256; SHA-1 is deprecated for XML signatures.
  • Make sure the service provider validates the signature, the audience, the destination and the time window on every response, and rejects messages with a DOCTYPE.
  • Keep your SAML library patched. Comment and signature wrapping bugs have affected several widely used libraries.

FAQ

Is the message sent to Vulnera?

No. Decoding and decompression run in your browser.

Can it check the signature?

No. Validating an XML signature needs canonicalisation and the identity provider's certificate; use your service provider's own logs for that.

Why does my Redirect message fail to decode?

Copy the whole SAMLRequest value including any URL encoding, or paste the complete URL.