ronutz

SAML Decoder

Paste a SAML Response or assertion (raw, base64, or URL-encoded) and decode its issuer, status, subject, conditions, audience, and attributes, with signature and weak-algorithm checks. Hardened against XXE.

Identity at tokens
Documentation

Decoding runs locally in your browser. Nothing is sent anywhere.

Web browser SSO (SP-initiated)

Service ProviderIdentity Provider
1A user requests a protected resource at the service provider2The SP builds an AuthnRequest and redirects the browser to the IdPAuthnRequest3The IdP receives the AuthnRequest over the Redirect bindingHTTP-Redirect4The IdP authenticates the user5The IdP issues a signed Response carrying an AssertionAssertion6The browser POSTs the SAMLResponse back to the SP's ACSHTTP-POST7The SP checks the signature, conditions, and audienceConditions8The SP establishes a session and grants access
API endpointGEThttps://ronutz.com/api/v1/saml-decoderDocumented, not served. Opens the specification.

Mga reperensya