SAML Response XML Decoder
SAML Response XML Decoder: Decodes Base64 container, formats XML structure, and extracts Issuer, Subject, Assertion, and Signature blocks.
About this saml response xml decoder
SAML Response XML Decoder — browser-based utility.
How this tool works
Treats leading-angle-bracket input as XML text or decodes Base64 and attempts raw Deflate, then strips tags with a regular expression, searches for Issuer, and returns a short preview. It does not decrypt, parse XML, or validate SAML signatures and assertions.
- Token Structure Extraction: Splits JWT strings on '.' delimiters into Header, Payload, and Signature segments.
- Base64URL Decoding: Decodes URL-safe Base64 segments into raw JSON strings without executing unverified signature payloads.
- Claims Parsing & Timestamp Evaluation: Parses registered claims ('exp', 'nbf', 'iat', 'iss', 'aud') and checks current clock validity.
- Cryptographic Status Reporting: Displays token signature algorithm (RS256, HS256, ES256, EdDSA) and warns that client decoding does not verify cryptographic signatures without the public key.
Worked example
Scenario: An enterprise SSO administrator decodes an encrypted or Base64-encoded SAML 2.0 AuthNResponse XML.
Sample input:
Processing: Decodes Base64 container, formats XML structure, and extracts Issuer, Subject, Assertion, and Signature blocks.
Illustrative output:
Limits and verification
Rejects strings that do not contain exactly two '.' delimiters. Explicitly informs the user that client-side decoding inspects token claims but CANNOT verify mathematical signature validity unless the corresponding public key/secret is supplied.
Examples demonstrate an expected workflow; they do not prove every input or every branch of an external specification. Check important results with an independent source before using them for money, security, compliance, safety, or irreversible file changes.
Browser processing boundary
Tool input is processed by code running in the browser and is not intentionally sent to a CZOA processing API. The page can still request ordinary site assets, analytics, or advertising when those services are enabled. Browser extensions and managed-device software remain outside this tool's control.
Relevant references
These references govern or help explain the format, protocol, or calculation used here. Listing a reference does not claim certification or complete implementation of every optional feature.
Content owner: CZOA Tools · Last reviewed: 2026-09-15 · Review methodology
How to use it
- Enter, paste, or select your input data into the SAML Response XML Decoder workspace controls.
- Review available parameter fields, units, formats, or options configured for your task.
- Click the action button or observe immediate live calculations rendered in your browser runtime.
- Inspect the resulting output and any diagnostic messages, then copy or download the result if needed.
Frequently asked questions
Which SAML representations can the decoder read?+
It accepts XML directly or base64 input; for base64 it first attempts DEFLATE decompression and otherwise interprets decoded bytes as text.
What did the browser fixture verify?+
An XML Response with issuer https://idp.example.test returned encoding xml, that issuer, a 28-character text value, and preview https://idp.example.test ada.
Does it validate a SAML signature or assertion trust?+
No. It extracts displayable fields only. Signature, certificate, audience, recipient, time, and trust validation require a dedicated SAML verifier.
What fields are returned after decoding?+
The JSON result records decoded status, source encoding, an optional Issuer value, normalized text character count, and a preview limited to 200 characters.