SAML Decoder

Decode Base64-encoded SAML assertions and responses to readable XML.

freeworks offlinenothing uploaded
Input
Output
—

About saml decoder

SAML Decoder needs nothing from a server once the page has loaded. Leave it open on a train with no signal and it carries on.

Because the work happens here, pasting production data carries no more risk than opening the file locally. Nothing is logged, since nothing arrives to log.

You will find it under Tokens, alongside 9 other tools for the same sort of job.

Handles URL-encoded and base64url input, pretty-prints XML with proper indentation.

How to use it

01
Start it
Every control is on the tool itself. Keyboard shortcuts, where there are any, are listed beside it.
02
Watch it run
It updates in the page as you go. Nothing is sent anywhere, so it keeps working with the network off.
03
Close when done
Nothing is stored between visits. Reloading gives you a clean start rather than picking up where you left off.

Examples

Decode SAML 2.0 Response with NameID assertion
Decode a Base64-encoded SAML response containing a user identity assertion
Input
PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIElEPSJfYWJjMTIzIj48c2FtbDpBc3NlcnRpb24geG1sbnM6c2FtbD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+PHNhbWw6U3ViamVjdD48c2FtbDpOYW1lSUQ+dXNlckBleGFtcGxlLmNvbTwvc2FtbDpOYW1lSUQ+PC9zYW1sOlN1YmplY3Q+PC9zYW1sOkFzc2VydGlvbj48L3NhbWxwOlJlc3BvbnNlPg==
Output
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="_abc123">
  <saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
    <saml:Subject>
      <saml:NameID>user@example.com</saml:NameID>
    </saml:Subject>
  </saml:Assertion>
</samlp:Response>

Questions

Does SAML Decoder work offline?+

Yes. It is JavaScript running in this tab, so once the page has loaded it needs nothing further from the network. Put the machine in flight mode and it carries on. Nothing you do here is sent anywhere, because there is nowhere for it to go.

Does it remember anything between visits?+

No. Reload the page and it starts from nothing. There is no account, no saved state and no cookie holding your last session. That is a deliberate trade: it cannot lose your data because it never keeps any.

Is it accurate?+

Timing comes from performance.now(), the high resolution clock the browser provides, rather than from setInterval, which drifts by a few milliseconds every tick and compounds over minutes. What can still shift things is the browser throttling a tab in the background, so leave it visible if the timing matters.

Does it make a sound?+

Where a sound makes sense, it is generated with the Web Audio API rather than loaded as a file, so there is nothing to download and nothing to block. Browsers refuse to start audio until you have interacted with the page, which is why the first press is what switches it on.

Can I use SAML Decoder on a phone?+

Yes. The controls are sized for touch and the layout collapses to one column on a narrow screen. Bear in mind that a phone locking its screen will suspend the page, and timing stops with it.