SAML Response Decoder & Assertion Inspector LOCAL ONLY

Decode a SAMLResponse or XML assertion, inspect identity claims and timing conditions, and surface configuration warnings without contacting an identity provider.

SAML content is decoded only in this browser. Remove production names, email addresses, session identifiers, and attributes before sharing a report.
SAMLResponse or assertion XMLBase64, URL-encoded Base64, or raw XML
SAML attributes
AttributeValue
No attributes inspected yet.
Decoded XML

Decode structure, then verify on the server

This inspector shows embedded XML and signature elements but does not validate XML signatures, trust chains, replay protection, recipient binding, or identity-provider metadata.

Recent tools: