Decode and inspect SAML assertions and responses. View XML attributes, conditions, and signature details.
Paste the SAMLResponse value captured from an SSO login, and this tool turns the opaque base64 blob back into the XML document behind it: the response status code, the assertion's issuer, subject and NameID, the conditions window, and the signature block. Decoding is trivial, because base64 is encoding, not encryption - so the tool's value is structuring the XML and surfacing the fields an SSO integration argument turns on. The common surprise: responses from HTTP-Redirect flows are DEFLATE-compressed before encoding, so a plain decode yields compressed binary instead of XML.
A SAMLResponse is the response XML encoded as base64, so the core step is reversing that encoding: map the base64 alphabet back to the original bytes, then parse the resulting document. Parsing yields a tree the tool can walk, and it extracts the elements SSO debugging depends on - StatusCode, Issuer, Subject and NameID, Conditions, AuthnStatement and Attributes - while also showing a pretty-printed copy of the full XML.
Signed assertions carry a ds:Signature element from XML Signature. Its SignedInfo names the digest and signature algorithms (RSA-SHA256 is common), DigestValue pins the assertion content, and KeyInfo often embeds the IdP's X.509 certificate. The tool surfaces these details plus the Conditions validity window (NotBefore, NotOnOrAfter) and the SubjectConfirmationData. These are inspection facts; cryptographically verifying the signature against the IdP's key is a separate step.
Most likely the response came from the HTTP-Redirect binding, which DEFLATE-compresses the XML before base64-encoding it, or the value was URL-encoded and + and / came through escaped. Inflate the decoded bytes, or URL-decode first. If the blob included a SAMLResponse=...= parameter wrapper, strip it. A clean decode starts with <samlp:Response or <saml:Assertion.
No and yes. The tool decodes the XML and shows its content; it does not verify the signature, which is the actual authenticity check and needs the IdP's certificate. And base64 is not encryption: anyone who sees the response, in the browser or a network capture, can decode it and read the NameID and attributes. This page decodes entirely in your browser and nothing is uploaded.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.