SAML Decoder & Inspector
Inspect SAML 2.0 requests and responses from an SSO investigation without uploading assertions, opening URLs or trusting the decoded message.
About SAML inspectorFeatures & how to use
Decode SAML XML, POST Base64 and Redirect deflate messages locally. Inspect assertions, audiences and timestamps without uploading SSO data.
What it can do
- Accept raw XML, HTTP-POST Base64 and HTTP-Redirect raw-deflate messages, including SAMLRequest or SAMLResponse query parameters.
- Inspect issuer, NameID, audiences, recipient, conditions, authentication context and attributes with namespace-aware parsing.
- Report signature elements and time conditions without claiming cryptographic verification or issuer trust; encrypted assertions are not decrypted.
- Reject DTD and entity declarations, bound XML size and depth, and display XML as inert text. Formatted XML is not suitable for signature verification.
How to use it
- Paste a SAML message, captured query or URL, or open a local file. No supplied URL is visited.
- Select the binding or use automatic detection, then choose Decode message.
- Review identity fields, timestamps and warnings. Use original XML when exact decoded content matters.