SAML decoder
Decode a SAML request or response, check its status, conditions and audience, list its attributes, and format its XML.
Everything happens in this browser. What you paste is not sent or stored, and leaving the page clears it.
What the decoder checks
The decoder reads the message with the browser's XML parser, which never fetches external entities, and shows it as text. It checks what a service provider checks before it trusts a response: a success status, exactly one assertion, its issuer, its audience, its validity window and the bearer confirmation. It shows where signatures are, but it does not verify XML signatures, which needs canonicalization and the identity provider's trusted certificate.