lc. Identity Tools
Tools

SAML decoder

Paste a SAMLRequest or SAMLResponse as it travels on the wire (POST or Redirect binding, or the whole URL) and read what the IdP and the SP are actually saying.

Processed locally, in your browser
Input

Accepts base64 (POST binding), base64 + deflate (Redirect binding), URL-encoded values, a full URL or form body with SAMLRequest / SAMLResponse, or plain XML.

Result

Paste a SAML message to decode it.

Notes

  • The HTTP-Redirect binding compresses the message with raw DEFLATE before base64 and URL-encoding; the HTTP-POST binding only base64-encodes it. The decoder detects which one it got.
  • Signatures are reported (where they are and which algorithms they use) but not cryptographically validated: that requires XML canonicalisation and the IdP certificate, and belongs in the SP.
  • An EncryptedAssertion can only be read with the SP private key, which should never be pasted into a web page.