VoriTools

SAML Response Decoder

Paste XML, Base64 or URL-encoded Base64 to inspect the assertion. The tool reports structure and signature presence; it does not validate XML signatures.

Runs locally in your browser
View category: Security & Cryptography (30)
SAML content is decoded only in this browser. Remove production names, email addresses, session identifiers, and attributes before sharing a report.
SAMLResponse or assertion XMLBase64, URL-encoded Base64, or raw XML
SAML attributes
AttributeValue
No attributes inspected yet.
Decoded XML

    
Decode structure, then verify on the server
This inspector shows embedded XML and signature elements but does not validate XML signatures, trust chains, replay protection, recipient binding, or identity-provider metadata.





How to decode a SAML response and read the assertion fields
The inspector takes a SAMLResponse the way it arrives — Base64, URL-encoded Base64 or the raw <samlp:Response> document — and lays out the fields inside: status code, issuer, NameID, audience, destination, InResponseTo, the object IDs, the Conditions window and every attribute value. Load example fills the field with a response template generated in the page and decodes it.
Decoding happens in the browser. In a measured session no request left the page except the site's own analytics, so a captured response can be pasted as it is. A response still carries production names, addresses and session identifiers, so remove them before a report is shared.
  1. Paste a SAMLResponse (Base64 or URL-encoded Base64) or a whole <samlp:Response> document into the field; Load example starts from a template whose timing window is centred on the current minute.
  2. Press Decode & inspect. The counters give the assertion, signature, attribute and character counts, and the summary lists status, issuer, subject, audience, destination, both IDs, InResponseTo and the two timing values.
  3. Read the findings list: it names a missing or present signature, an expired or not-yet-valid Conditions window, a missing Audience or Destination, and a status that is not Success.
  4. Check the attribute table for the claims a service provider would map, then use Copy report or the Copy button above the decoded XML.
  5. Press Clear before the next response so the previous panel does not stay on screen.
What the inspector reads, and what it only reports
What is read, and in what order
The decoder reads the first Response element, then the first Assertion inside it. Issuer, StatusCode, NameID, audience, destination, InResponseTo, IDs, Conditions and the AttributeStatement all come from that pairing. With two assertions in one response the counter reports 2, but the summary and the attribute table describe the first one only, and the SubjectConfirmationData window is not interpreted at all.
Input is normalised before decoding: whitespace and line breaks are dropped, URL-safe characters are accepted, missing padding is restored and a URL-encoded string is percent-decoded first. Raw XML is taken as it is. Anything else is refused with a reason: empty input, broken percent-encoding, invalid Base64, or the XML parser's position such as "line 1 at column 16: Element samlp:Response prefix is unbound".
Timing and signature checks
The Conditions window is compared with the browser clock and nothing else: a document whose NotOnOrAfter has passed is marked as expired, a document whose NotBefore lies in the future is marked as not yet valid, and an open window produces the neutral line about the browser clock. The comparison is a reading aid, not a replay check.
Signature handling is a count, not a verification. Zero ds:Signature elements produce the danger line; one or two produce the note that their cryptographic validity was not checked. Nothing here validates a certificate, a trust chain, IdP metadata, recipient binding or a replay cache.
Measured limits and privacy
A 1 MB attribute value decoded in about 0.3 seconds in a measured run, and the counters describe the document that was decoded last: a failed decode empties the summary, findings, attributes and decoded XML instead of leaving the previous result next to the error. Copy with nothing decoded answers with a sentence rather than a silent clipboard.
The page works offline once loaded and the input never leaves the browser. Treat the decoded report like the response it came from: it can contain names, mail addresses, group memberships and session identifiers.



    

        
Recent tools: