Tools
SAML decoder, explained
Paste a SAMLResponse, an AuthnRequest or an assertion to see what it says, element by element, in plain words.
Every element and every finding comes with the good practice and its exact source, with the strength of its words and the OASIS errata that changed it. Paste the AuthnRequest too, and the response is cross-checked against it.
Everything runs in your browser. Your message never leaves this page.
🔒 Your SAML message does not leave your browser. It often holds personal data: prefer an expired or test assertion.
Or try a sample
Synthetic and expired, signed with throwaway keys. Good practice comes with its AuthnRequest, to show the cross-check.
Or import a real login
Export a login from your browser as a HAR file (developer tools, Network tab, Save all as HAR) or from SAML-tracer, then open it here. The decoder finds the SAML messages, pairs each Response with its AuthnRequest and checks where they actually went.
🔒 A HAR also holds your cookies and anything typed during the login. This page reads the file in your browser and never sends it. Only the SAML messages are kept, in memory, until you clear or leave. Prefer a test account.
Nothing to decode yet. Paste a message above, or pick a sample.
Questions
Decode or verify?▾
Decoding only reads what the message says about itself, and anyone can write XML. Verifying checks the signature with the identity provider's key from your metadata, then the issuer, audience, recipient and dates. This page decodes and explains. Your service provider must verify.
Why sign the assertion or the Response?▾
With HTTP-POST, the assertion travels through the browser, which can change it. Since Errata E26, each assertion must be protected by a signature, on the assertion itself or on the whole Response. With CBC encryption, Errata E93 adds that the signature should sit above the encrypted element, on the Response.
What is XML Signature Wrapping?▾
A signature covers one element, named by its ID. An attacker keeps the signed element somewhere harmless, in Extensions or Advice, and puts a forged one where the application looks first. The verifier checks the genuine one and the application reads the fake. Somorovsky and colleagues showed in 2012 that many products fell for it.
Why a window of a few minutes?▾
A bearer assertion works for whoever holds it, and it cannot be revoked. The SAML security considerations ask for the shortest validity possible, typically a few minutes, and Errata E92 suggests tolerating 3 to 5 minutes of clock skew. Beyond that, only the service provider's replay cache stops a stolen copy.
What is an unsolicited response?▾
A Response the identity provider sends without a request from the service provider, also called IdP-initiated SSO. It has no InResponseTo, so the service provider cannot tell whether the user meant to sign in. Errata E90 asks that service providers be able to turn it off.
SAML or OpenID Connect?▾
NIST IR 8587, in its table 4, prefers modern open standards: OpenID Connect with OAuth, specifically the iGov profile, supports API and mobile services as well as traditional human-centric systems. It calls SAML a secure and proven protocol, more constrained and best suited to web applications, and notes that legacy can require running both.