SAML Response Decoder

Paste the value of the SAMLResponse form field and this decodes it, inflates it if it was compressed, and reads out the fields an SSO problem usually turns on: who issued it, where it was addressed, what the status says, who the subject is, and what window it is valid in. Everything happens in your own tab — a SAML assertion is a live credential, and pasting a production one into a server-side decoder hands it to whoever runs that server.

Two bindings, two encodings

An HTTP-POST binding sends the message Base64-encoded and nothing else. An HTTP-Redirect binding raw-DEFLATEs it first so the whole message survives being a query parameter. Rather than asking which you have, this detects: it decodes the Base64, and if the result is not XML it inflates, using the browser’s own DecompressionStream. The binding it found is reported with the result.

It decodes; it does not verify

A SAML signature can only be checked against the identity provider’s certificate, which this page does not have and will not ask you for. It reports that a Signature element is present, because presence is a fact it can establish — validity is not. Those are different things, and treating an unverified assertion as validated is the specific error that makes a decoder dangerous rather than merely limited. The same position the JWT Decoder takes, for the same reason.

Why a DOCTYPE is refused rather than ignored

A document type declaration is where XML external entity attacks live — the construct that turns parsing a document into reading a file off the parser’s host. A SAML message has no legitimate use for one, so a message carrying it is rejected and told so, rather than quietly stripped. If you are looking at one in an incident, that is itself the finding.

Conditions and the clock

The validity window is compared against your machine’s clock, and clock skew between it and the identity provider is a more common cause of a just-expired assertion than genuine lateness. That is why the raw NotBefore and NotOnOrAfter values are shown beside the verdict rather than only the verdict. NotOnOrAfter is exclusive: a time equal to it is already outside.

The sample is a synthetic Response for sp.example.com — fictional throughout, because shipping a captured assertion as sample data would publish the exact thing this tool exists to keep local. It carries a Success status, an email-format NameID, a one-hour conditions window that has long since closed, a signature this page can see and cannot check, and a multi-valued group attribute.