Back to Free Tools
FREE TOOLS
SAML Binding Decoder
Decode a SAML POST or Redirect payload into its original XML.
Binding, Encoded SAML payload
decoded-saml.xml, saml-binding-decoder.report.json
Browser only
Runs locally in your browser. Your files, pasted content and generated output are not uploaded. Reset clears this tool’s working data.
This tool needs JavaScript. If it does not load, refresh the page and try again.
How to use this tool
- Enter values using the examples, or choose a local file where requested. Follow the displayed supported input shapes and limits.
- Choose Calculate result and inspect the complete result.
- Download result to save the primary file. Where supplied, additional links save source files and the full JSON report. Reset restores examples and clears output.
Examples
Binding: POST
Encoded SAML payload: PHNhbWxwOkF1dGhuUmVxdWVzdCB4bWxuczpzYW1scD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiBJRD0iX2EiIFZlcnNpb249IjIuMCIgSXNzdWVJbnN0YW50PSIyMDI2LTEwLTIzVDAwOjAwOjAwWiIvPg==
Limitations
- Decode canonical padded Base64 POST or Base64 raw-DEFLATE Redirect into original UTF8 SAML2 protocol XML with a supported request/response root and Version2.0. Input is the decoded query-parameter value,not a full URL. At most100000 input/decoded UTF16 units,400000 expanded UTF8 bytes,20000 XML elements/40 levels. Redirect uses a chunked bounded native DecompressionStream and requires browser raw-DEFLATE support;truncated/trailing/wrapped streams refuse. XML1.0/UTF8 declaration only. No signing,signature/key trust,decryption or full SAML schema validation.
- Text fields are limited to100,000 UTF16 units each and400,000 combined UTF8 bytes; file fields have their own displayed limits. Combined output is at most4MiB. Processing stops after30 seconds; tool-specific bounds may be tighter.
- Generated source is a downloadable result and is not executed here. Inspection does not establish remote behavior, trust or standards certification.
Related tools
No items found.