What is HTTP-Redirect binding for SAML?

HTTP-Redirect sends SAMLRequest or SAMLResponse as a query parameter. The XML is usually DEFLATE compressed, then Base64 encoded, then URL encoded. HTTP-POST sends Base64 XML in a form field without DEFLATE.

Is it safe to decode SAML online?

This tool runs entirely in your browser. SAML requests are not uploaded. Do not paste live production secrets you are not allowed to share on any website.

Where is the SAML response decoder?

Use the dedicated SAML Response Decoder page on this site to inspect SAMLResponse assertions, attributes, and conditions after login.

SAML Request Decoder

Decode SAMLRequest and AuthnRequest payloads from SSO redirect URLs

Use this free SAML request decoder to decode SAMLRequest and AuthnRequest XML from Okta, Auth0, Entra ID, and other IdPs. Paste a redirect URL, query string, Base64 blob, or raw XML. The tool handles URL decoding, Base64, and DEFLATE for HTTP-Redirect binding. For login responses, open the SAML Response Decoder. Fully client-side.

SAML Input

Paste a redirect URL, a SAMLRequest or SAMLResponse value, Base64, or raw XML. Decoding runs as you type, in your browser.

Waiting for input

Related SSO tools

Quick Reference

Request attributes

`Issuer`	SP entity ID sending the request
`Destination`	IdP SSO endpoint URL
`AssertionConsumerServiceURL`	SP ACS URL for the response
`ProtocolBinding`	Usually HTTP-POST for ACS
`RelayState`	Opaque state from the query string (not inside XML)

Bindings

`HTTP-Redirect`	DEFLATE + Base64 + URL encode in query
`HTTP-POST`	Base64 XML in a hidden form field
`ForceAuthn`	IdP must re-authenticate the user
`NameIDPolicy`	Requested name identifier format

SAML request debugging guide

What is a SAML AuthnRequest?

A SAML AuthnRequest asks an Identity Provider to authenticate a user and return a signed SAMLResponse to your Service Provider ACS URL. The request is XML wrapped as SAMLRequest on redirect or POST.

HTTP-Redirect vs HTTP-POST

HTTP-Redirect compresses the XML with DEFLATE, Base64 encodes it, and places it in the query string. HTTP-POST Base64 encodes the XML without DEFLATE and auto-posts a form. This decoder auto-detects both.

Typical SSO failures at the request

Wrong AssertionConsumerServiceURL in the SP metadata versus what the IdP expects.
Missing or mismatched Issuer entity ID.
Corrupt DEFLATE or double URL encoding on the SAMLRequest parameter.

SAML Request Decoder FAQ

How do I decode a SAMLRequest from a redirect URL?

Paste the full URL or the SAMLRequest= value. The decoder URL decodes, Base64 decodes, and inflates DEFLATE when needed.

What is HTTP-Redirect binding?

It sends SAML in the query string using DEFLATE, Base64, and URL encoding. It is common for SP-initiated SSO to Okta and similar IdPs.

Is my SAML request uploaded?

No. Decoding runs locally in JavaScript. Nothing is sent to a server.

How do I decode SAMLResponse?

Use the SAML Response Decoder to inspect assertions, attributes, and certificate signatures.