Free SAML Response Decoder
Paste a SAMLResponse, a SAMLRequest from a redirect URL, or raw XML to read the status, user, conditions and attributes.
What is a SAML Response Decoder?
SAML 2.0 is how many companies sign users in to their apps: the identity provider sends the app a signed XML response saying who the user is. In the browser it travels as a long Base64 string. This decoder turns it back into readable lines and checks it.
It reads raw XML, Base64 from the HTTP-POST binding, DEFLATE-compressed values from redirect URLs, and form or query parameters. Responses, assertions, login requests and logout messages are summarised: status, issuer, NameID, conditions, authentication context and attributes, with checks on timing, recipient, audience and signature algorithms.
Key Features
Every Encoding
XML, Base64, DEFLATE from redirect URLs, and SAMLResponse or SAMLRequest form parameters.
Readable Summary
Status and reason, issuer, NameID, conditions, authentication context, session and attributes.
Practical Checks
Validity window, IssueInstant, recipient, InResponseTo, audience and SHA-1 signatures.
Pretty XML
The decoded XML indented one element per line, ready to read or download.
Assertions Stay Private
Decoding happens in your browser, so user data and tokens never leave it.
Perfect for everyone
- Identity and access engineers
- App developers adding SSO
- IT admins configuring Okta
- Entra ID or Google Workspace
- Security reviewers
How to Use the SAML Response Decoder
Capture the message from the browser, then paste it.
Capture It
Use the browser’s network tab or a SAML tracer extension to copy SAMLResponse or SAMLRequest.
Paste It
The value alone, the whole form body, a redirect URL’s query string, or the XML.
Read the Summary
Status, user, conditions and attributes come first, with warnings beside them.
Check the XML
Switch to XML to read the raw message, signature and all.
SAML Messages, Decoded
Each row is a SAML message as it crosses the browser, and each answer is this decoder’s output in the mode on the chip. The identity provider, app and user are fictional, and signature values are truncated.
“PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iIElEPSJfcjhmMmMxIiBJblJlc3BvbnNlVG89Il9yZXE0NDcxIiBWZXJzaW9uPSIyLjAiIElzc3VlSW5zdGFudD0iMjAyNi0xMC0yOFQwOToxNTowMloiIERlc3RpbmF0aW9uPSJodHRwczovL2FwcC5leGFtcGxlLmNvbS9zYW1sL2FjcyI+PHNhbWw6SXNzdWVyPmh0dHBzOi8vaWRwLmV4YW1wbGUuY29tL21ldGFkYXRhPC9zYW1sOklzc3Vlcj48c2FtbHA6U3RhdHVzPjxzYW1scDpTdGF0dXNDb2RlIFZhbHVlPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6c3RhdHVzOlN1Y2Nlc3MiLz48L3NhbWxwOlN0YXR1cz48c2FtbDpBc3NlcnRpb24gSUQ9Il9hOTFkM2UiIFZlcnNpb249IjIuMCIgSXNzdWVJbnN0YW50PSIyMDI2LTEwLTI4VDA5OjE1OjAyWiI+PHNhbWw6SXNzdWVyPmh0dHBzOi8vaWRwLmV4YW1wbGUuY29tL21ldGFkYXRhPC9zYW1sOklzc3Vlcj48ZHM6U2lnbmF0dXJlIHhtbG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj48ZHM6U2lnbmVkSW5mbz48ZHM6Q2Fub25pY2FsaXphdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjxkczpTaWduYXR1cmVNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGRzaWctbW9yZSNyc2Etc2hhMjU2Ii8+PGRzOlJlZmVyZW5jZSBVUkk9IiNfYTkxZDNlIj48ZHM6RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2Ii8+PGRzOkRpZ2VzdFZhbHVlPnEyTGbigKY8L2RzOkRpZ2VzdFZhbHVlPjwvZHM6UmVmZXJlbmNlPjwvZHM6U2lnbmVkSW5mbz48ZHM6U2lnbmF0dXJlVmFsdWU+TXpr4oCmPC9kczpTaWduYXR1cmVWYWx1ZT48ZHM6S2V5SW5mbz48ZHM6WDUwOURhdGE+PGRzOlg1MDlDZXJ0aWZpY2F0ZT5NSUlD4oCmPC9kczpYNTA5Q2VydGlmaWNhdGU+PC9kczpYNTA5RGF0YT48L2RzOktleUluZm8+PC9kczpTaWduYXR1cmU+PHNhbWw6U3ViamVjdD48c2FtbDpOYW1lSUQgRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoxLjE6bmFtZWlkLWZvcm1hdDplbWFpbEFkZHJlc3MiPmFkYUBleGFtcGxlLmNvbTwvc2FtbDpOYW1lSUQ+PHNhbWw6U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxzYW1sOlN1YmplY3RDb25maXJtYXRpb25EYXRhIEluUmVzcG9uc2VUbz0iX3JlcTQ0NzEiIFJlY2lwaWVudD0iaHR0cHM6Ly9hcHAuZXhhbXBsZS5jb20vc2FtbC9hY3MiIE5vdE9uT3JBZnRlcj0iMjAyNi0xMC0yOFQwOToyMDowMloiLz48L3NhbWw6U3ViamVjdENvbmZpcm1hdGlvbj48L3NhbWw6U3ViamVjdD48c2FtbDpDb25kaXRpb25zIE5vdEJlZm9yZT0iMjAyNi0xMC0yOFQwOToxNDozMloiIE5vdE9uT3JBZnRlcj0iMjAyNi0xMC0yOFQwOToyMDowMloiPjxzYW1sOkF1ZGllbmNlUmVzdHJpY3Rpb24+PHNhbWw6QXVkaWVuY2U+aHR0cHM6Ly9hcHAuZXhhbXBsZS5jb20vc2FtbC9tZXRhZGF0YTwvc2FtbDpBdWRpZW5jZT48L3NhbWw6QXVkaWVuY2VSZXN0cmljdGlvbj48L3NhbWw6Q29uZGl0aW9ucz48c2FtbDpBdXRoblN0YXRlbWVudCBBdXRobkluc3RhbnQ9IjIwMjYtMTAtMjhUMDk6MTQ6NThaIiBTZXNzaW9uSW5kZXg9Il9zNTVhMSIgU2Vzc2lvbk5vdE9uT3JBZnRlcj0iMjAyNi0xMC0yOFQxNzoxNTowMloiPjxzYW1sOkF1dGhuQ29udGV4dD48c2FtbDpBdXRobkNvbnRleHRDbGFzc1JlZj51cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YWM6Y2xhc3NlczpQYXNzd29yZFByb3RlY3RlZFRyYW5zcG9ydDwvc2FtbDpBdXRobkNvbnRleHRDbGFzc1JlZj48L3NhbWw6QXV0aG5Db250ZXh0Pjwvc2FtbDpBdXRoblN0YXRlbWVudD48c2FtbDpBdHRyaWJ1dGVTdGF0ZW1lbnQ+PHNhbWw6QXR0cmlidXRlIE5hbWU9InVybjpvaWQ6MC45LjIzNDIuMTkyMDAzMDAuMTAwLjEuMyIgRnJpZW5kbHlOYW1lPSJtYWlsIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZT5hZGFAZXhhbXBsZS5jb208L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48c2FtbDpBdHRyaWJ1dGUgTmFtZT0iZ3JvdXBzIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZT5lbmdpbmVlcmluZzwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48c2FtbDpBdHRyaWJ1dGVWYWx1ZT5hZG1pbnM8L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48L3NhbWw6QXR0cmlidXRlU3RhdGVtZW50Pjwvc2FtbDpBc3NlcnRpb24+PC9zYW1scDpSZXNwb25zZT4=”
“fZJLT8MwEIT/iuV7XqXiYSWRQitEpQIRDRy4oCVZqCU/Uq8D5d9jUhAFiV5n5/PsaJ0TaNWLavBrc4ubAcmzrVaGxDgo+OCMsECShAGNJHwrVtXVUkziVPTOettaxfeQwwQQofPSGs4W84I/OtxMpycZZ/foKMgFD64wIxpwYciD8UFKJ8dRlkaT0yY9E9lUHGUPnM3DqtKAH6m19z2JJJFdH+MWdK8wbq1OiCxn1XfozBoaNLoVulfZ4t3t8oeE/g8ZuiTQEmf1V8tzaTppXg4XfNqZSFw2TR3VN6uGl/nnW2Ls5MqDeRo9dOAhT/aRfHej6xC2mNdWyfadXVinwf+/SxZnoyK76Hm0CtQgVdV1DimUqpSybzOH4LHg3g3Ik3KX+vszlB8=”
“<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_r0001" InResponseTo="_req4472" Version="2.0" IssueInstant="2026-10-28T09:16:10Z" Destination="https://app.example.com/saml/acs"><saml:Issuer>https://idp.example.com/metadata</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:AuthnFailed"/></samlp:StatusCode><samlp:StatusMessage>User account is locked</samlp:StatusMessage></samlp:Status></samlp:Response>”
“fZJLT8MwEIT/iuV7XqXiYSWRQitEpQIRDRy4oCVZqCU/Uq8D5d9jUhAFiV5n5/PsaJ0TaNWLavBrc4ubAcmzrVaGxDgo+OCMsECShAGNJHwrVtXVUkziVPTOettaxfeQwwQQofPSGs4W84I/OtxMpycZZ/foKMgFD64wIxpwYciD8UFKJ8dRlkaT0yY9E9lUHGUPnM3DqtKAH6m19z2JJJFdH+MWdK8wbq1OiCxn1XfozBoaNLoVulfZ4t3t8oeE/g8ZuiTQEmf1V8tzaTppXg4XfNqZSFw2TR3VN6uGl/nnW2Ls5MqDeRo9dOAhT/aRfHej6xC2mNdWyfadXVinwf+/SxZnoyK76Hm0CtQgVdV1DimUqpSybzOH4LHg3g3Ik3KX+vszlB8=”
“SAMLResponse=PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iIElEPSJfcjAwMDEiIEluUmVzcG9uc2VUbz0iX3JlcTQ0NzIiIFZlcnNpb249IjIuMCIgSXNzdWVJbnN0YW50PSIyMDI2LTEwLTI4VDA5OjE2OjEwWiIgRGVzdGluYXRpb249Imh0dHBzOi8vYXBwLmV4YW1wbGUuY29tL3NhbWwvYWNzIj48c2FtbDpJc3N1ZXI%2BaHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20vbWV0YWRhdGE8L3NhbWw6SXNzdWVyPjxzYW1scDpTdGF0dXM%2BPHNhbWxwOlN0YXR1c0NvZGUgVmFsdWU9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpzdGF0dXM6UmVzcG9uZGVyIj48c2FtbHA6U3RhdHVzQ29kZSBWYWx1ZT0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnN0YXR1czpBdXRobkZhaWxlZCIvPjwvc2FtbHA6U3RhdHVzQ29kZT48c2FtbHA6U3RhdHVzTWVzc2FnZT5Vc2VyIGFjY291bnQgaXMgbG9ja2VkPC9zYW1scDpTdGF0dXNNZXNzYWdlPjwvc2FtbHA6U3RhdHVzPjwvc2FtbHA6UmVzcG9uc2U%2B&RelayState=%2Fdashboard”
“<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_r8f2c1" InResponseTo="_req4471" Version="2.0" IssueInstant="2026-10-28T09:15:02Z" Destination="https://app.example.com/saml/acs"><saml:Issuer>https://idp.example.com/metadata</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><saml:Assertion ID="_a91d3e" Version="2.0" IssueInstant="2026-10-28T09:15:02Z"><saml:Issuer>https://idp.example.com/metadata</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><ds:Reference URI="#_a91d3e"><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>q2Lf…</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>Mzk…</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIC…</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">ada@example.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData InResponseTo="_req4471" Recipient="https://other.example.net/acs" NotOnOrAfter="2026-10-28T09:20:02Z"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2026-10-28T09:14:32Z" NotOnOrAfter="2026-10-28T09:20:02Z"><saml:AudienceRestriction><saml:Audience>https://app.example.com/saml/metadata</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2026-10-28T09:14:58Z" SessionIndex="_s55a1" SessionNotOnOrAfter="2026-10-28T17:15:02Z"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" FriendlyName="mail"><saml:AttributeValue>ada@example.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="groups"><saml:AttributeValue>engineering</saml:AttributeValue><saml:AttributeValue>admins</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>”
“<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_r8f2c1" InResponseTo="_req4471" Version="2.0" IssueInstant="2026-10-28T09:15:02Z" Destination="https://app.example.com/saml/acs"><saml:Issuer>https://idp.example.com/metadata</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><saml:Assertion ID="_a91d3e" Version="2.0" IssueInstant="2026-10-28T09:15:02Z"><saml:Issuer>https://idp.example.com/metadata</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#_a91d3e"><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>q2Lf…</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>Mzk…</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIC…</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">ada@example.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData InResponseTo="_req4471" Recipient="https://app.example.com/saml/acs" NotOnOrAfter="2026-10-28T09:20:02Z"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2026-10-28T09:14:32Z" NotOnOrAfter="2026-10-28T09:20:02Z"><saml:AudienceRestriction><saml:Audience>https://app.example.com/saml/metadata</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2026-10-28T09:14:58Z" SessionIndex="_s55a1" SessionNotOnOrAfter="2026-10-28T17:15:02Z"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" FriendlyName="mail"><saml:AttributeValue>ada@example.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="groups"><saml:AttributeValue>engineering</saml:AttributeValue><saml:AttributeValue>admins</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>”
“<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_r77" Version="2.0" IssueInstant="2026-10-28T09:15:02Z"><saml:Issuer>https://idp.example.com/metadata</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><saml:EncryptedAssertion><xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/></saml:EncryptedAssertion></samlp:Response>”
“<samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_lo1" Version="2.0" IssueInstant="2026-10-28T17:00:00Z" Destination="https://idp.example.com/slo"><saml:Issuer>https://app.example.com/saml/metadata</saml:Issuer><saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">ada@example.com</saml:NameID><samlp:SessionIndex>_s55a1</samlp:SessionIndex></samlp:LogoutRequest>”
“hello world”
What’s Inside a SAML Response
A SAML login response nests the same parts every time. These ten carry the answers to most SSO questions.
Status
Whether the identity provider succeeded, with a second-level code saying why it didn’t.
“What does AuthnFailed mean?”
Issuer
The identity provider’s entity ID, which the app must recognise.
“Where does the app check it?”
Assertion
The signed statement about the user, inside the response.
“Can a response hold several?”
NameID
The user’s identifier, in a format such as email or persistent.
“What does persistent mean?”
SubjectConfirmation
Bearer data: where the assertion may be used and until when.
“Which method do browser logins use?”
Conditions
The window in which the assertion is valid, usually a few minutes.
“What if the clock is off?”
Audience
Which service provider the assertion is meant for.
“Why does it matter?”
AuthnStatement
When and how the user authenticated, and the session index.
“What is SessionIndex for?”
Attributes
Extra user data such as email, name and group membership.
“Who decides which are sent?”
Signature
An XML signature over the response or assertion, checked with the IdP’s certificate.
“Does this tool verify it?”
How SAML Travels
SAML messages are carried by the browser between the identity provider and the app, and the way each one is encoded depends on its binding. Knowing which binding you’re looking at explains the encoding you need to undo.
HTTP-POST
The response is Base64 in a hidden form field named SAMLResponse, posted to the app’s ACS URL.
HTTP-Redirect
Requests travel in a URL query string, compressed with DEFLATE, then Base64 and URL encoded.
RelayState
An opaque value the app sends with the request and gets back, often the page to return to.
ACS URL
The assertion consumer service, the app endpoint that receives and checks responses.
SP-Initiated
The app sends an AuthnRequest first, so the response carries InResponseTo.
IdP-Initiated
The user starts at the identity provider, so there is no request and no InResponseTo.
Common SSO Failures
Most SAML errors come down to a mismatch between what the identity provider sends and what the app expects. These are the ones to check first when a login fails.
Clock Skew
If server clocks differ, a fresh assertion can look expired or not yet valid.
Wrong Audience
The audience must equal the app’s entity ID exactly, including any trailing slash.
Recipient Mismatch
The recipient must be the ACS URL the response was posted to.
Certificate Rollover
After the IdP rotates its signing certificate, apps with the old one reject every login.
NameID Format
Asking for an email NameID when the IdP sends a persistent ID breaks user matching.
Missing Attributes
Apps that need groups or names fail if the IdP isn’t set up to release them.
NameID Formats
The NameID format decides what identifier the app receives for the user, and it’s the most common setting to get wrong when connecting an app to an identity provider. These are the formats you will meet.
emailAddress
The user’s email address. Simple to map, but it changes if the user’s email changes.
persistent
An opaque ID that stays the same for this user and app, and differs between apps.
transient
A one-time ID for this login only, used when the app shouldn’t track the user.
unspecified
The IdP decides. Often an email or username, so check what it actually sends.
X509SubjectName
The subject of the user’s certificate, used where logins are certificate based.
When to Decode SAML
Whenever single sign-on isn’t doing what you expect.
Setting Up SSO
Check the attributes and NameID an identity provider actually sends.
Debugging Failed Logins
Read the status, conditions and audience of the response that failed.
Support Tickets
Decode a customer’s captured response to see what their IdP sent.
Security Reviews
Spot SHA-1 signatures, missing audiences and long validity windows.
Learning SAML
See how requests, responses and assertions fit together.
Handling SAML Safely
SAML responses are live credentials for a few minutes, so treat them with care.
Don’t Paste Fresh Responses Online
A valid response can log someone in until it expires. Decode it locally, like here.
Never Trust Unverified Data
Decoding isn’t verifying. Apps must check the signature with the IdP’s certificate.
Signature Wrapping
Check that the signed element is the one being used, by matching the reference ID.
Prefer Signed Assertions
Signing the assertion, not only the response, protects it if it’s extracted.
Redact Before Sharing
Remove names, emails and group lists from responses attached to tickets.