SAML response inspector
Decode a SAML response or request in your browser and read its issuer, status, subject, conditions, audience and attributes. Personal data is masked by default, and nothing is sent anywhere.
Input up to 1000000 characters, decoded messages up to 2000000 bytes, 64 levels and 20000 elements. Decoding runs locally in a background worker. Download a JSON report, plus the decoded XML when masking is off. Paste the SAMLResponse value, a redirect URL or the XML. Up to 1,000,000 characters. Review the settings before running.
Your result
How to use SAML response inspector
- Paste the SAMLResponse value, the whole redirect URL or the XML.
- Enter the time to check the validity windows against.
- Keep masking on if you plan to share the report.
- Run the tool and review the assertion details.
Useful next steps
Bindings
HTTP-POST messages are Base64; HTTP-Redirect messages are raw DEFLATE, then Base64 and URL encoding, as defined in the SAML 2.0 bindings specification (OASIS, March 2005). The tool detects which one you pasted and also accepts plain XML.
Safe parsing
XML with a DOCTYPE or entity declarations is refused before parsing, so entity expansion and external entity attacks cannot run. Depth, element count and size are bounded, and any parser warning stops the run.
What it shows and does not check
Time windows are compared with the time you enter, with NotOnOrAfter exclusive. Times are read as xs:dateTime in UTC, as SAML core section 1.3.3 requires: a time without a zone is UTC, an offset such as +02:00 is applied, and any other form is reported as unreadable-time. Signatures are listed, not verified; use the SAML signature verifier with your identity provider certificate for that. Encrypted assertions are counted but not decrypted.