SAML Decoder
Decode a SAMLRequest or SAMLResponse from the redirect or POST binding and read the issuer, NameID, audience, validity window, attributes and status.
Free · No sign-up · Your inputs stay in your browser
Input
Decode a SAML request or response
Output
Decoding...
The redirect binding deflates the XML before base64-encoding it to fit in a URL; the POST binding only base64-encodes it. This page decodes either and reads the fields that usually explain a failed login: the issuer, the audience, the validity window (clock skew between IdP and SP is the classic cause) and the status. It does not verify the signature.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Where SSO logins fail
The usual causes show up in exactly these fields: an Audience that does not match the service provider's entity ID, a NotOnOrAfter in the past because the IdP's and SP's clocks differ, a NameID format the SP does not expect, an attribute released under a different name, or a status that is not Success. The bindings are defined in the SAML 2.0 bindings specification.
Capturing the message
Browser extensions such as SAML-tracer, or the network panel with Preserve log on, show the SAMLResponse posted to the assertion consumer service. It contains personal data, so decode it locally as here.