Question 1

How do I decode a Base64-encoded SAML Response?

Accepted Answer

Paste the Base64 string into the text area and click 'Decode SAML'. The tool automatically detects SAML Responses, Assertions, and AuthnRequests, handles URL-safe Base64 variants, and decompresses DEFLATE-encoded data.

Question 2

How can I analyze the signature on a SAML assertion?

Accepted Answer

After decoding, click the 'Signature' tab to view the full analysis. The tool extracts the signing algorithm (RSA-SHA256, etc.), canonicalization method, X.509 certificate details (subject, issuer, validity dates, SHA-256 fingerprint), and performs structure validation checks including SHA-1 deprecation warnings.

Question 3

What does 'enveloped signature transform' mean in SAML?

Accepted Answer

The enveloped signature transform tells the verifier to remove the Signature element itself before computing the digest. This is necessary because the signature is inside the signed element — without this transform, the signature value would change the digest, creating a circular dependency.

Question 4

Is my SAML data sent to a server for decoding?

Accepted Answer

No. All decoding, XML parsing, signature analysis, and X.509 certificate parsing is performed entirely in your browser using JavaScript. No SAML data is transmitted to any server.

SAML Decoder Online - Decode SAML Assertions & Responses Free

Written by IAMDevBox

Latest Articles