Capture a SAMLResponse during SSO
Use browser DevTools on the ACS POST: copy the SAMLResponse hidden field. For redirect binding, copy the query parameter from the location bar before the page navigates away.
SAML Response Decoder
Decode SAMLResponse assertions, attributes, and signing certificates
Decode SAMLResponse XML after enterprise SSO login. This SAML response decoder reads StatusCode, NameID, Conditions, AttributeStatement, and embedded X.509 certificates. Paste Base64 from an HTTP-POST ACS callback, a redirect URL, or raw XML. To debug outbound requests, use the SAML Request Decoder. Fully client-side.
Related SSO tools
Quick Reference
Response
StatusCode | Success or failure URI |
InResponseTo | AuthnRequest ID this answers |
Destination | SP ACS URL |
Issuer | IdP entity ID |
Assertion
NameID | Stable user identifier |
Audience | SP entity ID allowed to consume the assertion |
NotOnOrAfter | Assertion expiry (clock skew matters) |
SessionIndex | Logout correlation token |
SAML response debugging guide
Validate timing and audience
Check NotBefore and NotOnOrAfter against your server clock. Confirm Audience matches your SP entity ID. Skew or wrong audience is a frequent cause of silent login failures.
Certificates and signatures
When an X509Certificate is present, compare the SHA-256 fingerprint with the cert registered in your SP. For full PEM inspection, use the SSL/TLS Certificate Decoder.
SAML Response Decoder FAQ
How do I decode a SAMLResponse?
Paste the SAMLResponse form field, redirect parameter, or XML. The tool decodes Base64 and DEFLATE when needed.
How do I read SAML attributes?
Look at the AttributeStatement table for each attribute name and value returned by the IdP.
Is my SAML response uploaded?
No. Parsing stays in your browser with JavaScript only.
How do I decode SAMLRequest?
Use the SAML Request Decoder for AuthnRequest payloads before login.