Minimal SAML response
PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIFZlcnNpb249IjIuMCIvPg==
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Version="2.0"/>
Encoding Tools
SAML Decoder
Decode a Base64 SAML response and inspect beautified XML locally in your browser.
Processed locally · Your input stays in your browser
Beautified XML
bytebench / saml-decoderLocal
Beautified SAML XML
Ready when you are.
Paste a Base64 SAML response to begin.
How to use this tool
Paste a Base64 SAMLResponse to decode and beautify its XML locally. Inspect response status, issuer, subject, and attributes without uploading authentication data.
- Paste or type your input into the tool area.
- Wait for the response to decode and review the beautified XML.
- Review validation messages before copying the output.
- Use the example button when you want a known-good starting point.
Examples
Common use cases
- Debug SAML HTTP POST responses during SSO integration.
- Inspect issuer, NameID, status codes, and assertion attributes.
- Turn a Base64 response from browser developer tools into readable XML.
When to use this tool
Use this saml decoder page when you need to decode Base64 SAML responses into readable XML quickly during debugging, review, migration, or documentation work and want to keep raw input in your browser session.
If your task shifts, Base64 Decode and Encode and XML Formatter are usually the next useful tools.
Input and output expectations
- Expected input shape: Paste the exact value you want to inspect, decode, parse, or transform, including delimiters when relevant.
- Typical output: A converted or parsed representation you can copy into debugging notes, requests, tests, or scripts.
- Quick input example: PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIFZlcnNpb249IjIuMCIvPg==
- Quick output example: <samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Version="2.0"/>
Common mistakes to avoid
- Using decode mode when the input is already decoded.
- Mixing URL-safe and standard variants in encoded data.
- Comparing transformed output without confirming source mode.
Notes and edge cases
Supports UTF-8 SAML 2.0 Response XML up to 1 MB of Base64 input. Rejects DOCTYPE declarations and excessive nesting. Preserves mixed text, CDATA, and xml:space content. Does not validate signatures or decrypt assertions.
For privacy-sensitive data, keep using the tool in a trusted browser session and avoid pasting secrets into shared screens, screenshots, browser extensions, or remote support sessions.
FAQ
Does this SAML decoder upload my response?
No. Base64 decoding and XML formatting run locally in your browser. Responses are not saved in browser storage or included in custom analytics events.
What should I paste?
Paste the Base64 value of the SAMLResponse field from an HTTP POST, without the field name or form body. Whitespace and omitted Base64 padding are accepted. Percent-encoded or compressed messages must be decoded separately first.
Does decoding verify the SAML response?
No. Well-formed XML does not establish signature validity, issuer trust, audience, expiration, or SAML schema compliance. Use your service provider to validate the original response; formatting may change signed XML.