SAML Response Base64 Decoder

SSO just failed, the service provider log says invalid assertion and nothing else, and all you have is a huge base64 blob copied out of DevTools or a SAML tracer. Until you see the XML you cannot tell whether it is a clock skew, a wrong audience, or an attribute the identity provider stopped sending. Decoding it and reading it is always step one.

This page base64-decodes the blob and re-indents the XML, which covers the POST binding, where SAMLResponse travels as plain base64-encoded XML. The HTTP-Redirect binding raw-deflates the payload first, and the tool does not unpack that: it notices the bytes do not start with an angle bracket, says so, and prints the leading bytes in hex. Despite what the tool description implies, no inflate is bundled. Strip any URL-encoding before pasting too.

Once the XML is on screen, start with NotOnOrAfter, the top cause of failures when clocks drift, then check Issuer and Subject: when those fields exist the tool summarises them on one line above the XML. It does not verify signatures or certificates, so pretty XML is not a valid assertion. One display caveat: decoding is byte-wise latin-1, so accented names render as mojibake even though the XML itself is intact. Nothing is uploaded, but an assertion is a credential, so close the tab afterwards.