FormatterHQ
JSON Tools XML Tools YAML Tools CSV & TSV Tools HTML Tools CSS Tools JavaScript Tools SQL Tools Code Formatters & Beautifiers Minifiers Validators Data Converters Data to Class Generators Escape & Unescape Encode & Decode Base64 Tools Hash & Cryptography String & Text Utilities Number Converters Color Converters Unit Converters IP & Network Tools Random Data Generators Diff & Compare Viewers & Editors Image Tools PDF Tools Markdown Tools SEO & Webmaster Tools Developer Utilities JSON Formatter PDF Tools XML Formatter Beautifiers Converters Blog

Base64 to XML

Decode Base64-encoded XML — SAML responses, SOAP attachments, embedded documents — and read it with XML highlighting.

Loading tool…
Ready.

How to use the Base64 to XML

  1. Type or paste into the Base64 box, or click Sample. You can also drop a file on a box or use its Open file button.
  2. The XML box updates live as you type. It works both ways — edit the XML side to convert back, or click ⇄ Swap to exchange the sides.
  3. Alphabet and Wrap lines at 76 chars (MIME) in the options bar above the editors only affect the reverse direction — the Base64 output you get when you type in the XML box.
  4. Use Copy or Download on either box to take the result, or Clear to start again.

Base64 to XML decoder

The Base64 to XML tool decodes a Base64 string and displays the XML inside with syntax highlighting. It is especially useful for single sign-on debugging: copy the SAMLResponse value from your browser’s network panel, paste it here, and read the assertion, its attributes, conditions and timestamps.

Example

Base64 input:

PD94bWwgdmVyc2lvbj0iMS4wIj8+Cjxub3RlPgogIDx0bz5Ub3ZlPC90bz4KICA8Ym9keT5Eb24ndCBmb3JnZXQgbWUhPC9ib2R5Pgo8L25vdGU+

Decoded XML:

<?xml version="1.0"?>
<note>
  <to>Tove</to>
  <body>Don't forget me!</body>
</note>

Debugging SAML with this tool

  1. Open the browser developer tools, go to the Network tab and find the POST to your service provider’s assertion consumer URL.
  2. Copy the SAMLResponse form field. If it contains %2B or %3D, it is still URL-encoded — decode it with the URL Decoder first.
  3. Paste it here and check the Issuer, Audience, NotBefore/NotOnOrAfter times, NameID and attribute statements.

SAML requests sent with the redirect binding (in the URL as SAMLRequest=) are DEFLATE-compressed before Base64 encoding, so decoding them here shows binary data. Inflate them with Zlib Decompress, which handles raw DEFLATE.

What to look for in a SAML response

ElementWhat to check
IssuerThe identity provider’s entity ID, exactly as your service provider expects it.
StatusCodeShould end in :Success; other values explain why login failed.
NameIDThe user identifier and its format (email, persistent ID, and so on).
ConditionsNotBefore and NotOnOrAfter — clock differences between servers are a frequent cause of rejected logins.
AudienceRestrictionMust match your service provider’s entity ID.
AttributeStatementThe user attributes (email, groups, names) your application maps.

Troubleshooting

  • Hex dump instead of XML. The data is binary — compressed, encrypted (as with an EncryptedAssertion’s cipher value) or not XML at all.
  • “unexpected character”. The string still contains URL encoding or JSON escaping such as \/. Clean it up and try again.
  • Hex dump although the data is XML. The XML may use an encoding other than UTF-8, such as UTF-16. Bytes that are not valid UTF-8 are shown as a hex dump, never as garbled characters.

Recognizing Base64 XML before you decode it

Every XML document starts with <, so Base64-encoded XML almost always begins with the letter P. A few longer prefixes are worth knowing:

  • PD94bWwg is <?xml , a document with an XML declaration.
  • PHNhbWxwOlJl is <samlp:Re, the start of a SAML response or request.
  • //48 is a UTF-16 byte order mark followed by <. The XML is in UTF-16, which is not valid UTF-8, so this tool shows it as a hex dump.
  • No P at the start usually means the XML was compressed before encoding, as SAML redirect bindings do with raw DEFLATE; inflate it with the zlib decompressor first.

Security reminder

A SAML response is a login credential for as long as it is valid. Decoding it locally is fine, and this tool uploads nothing unless you click Save & Share, but avoid creating share links for real assertions or posting them in tickets or chat. After decoding, you can tidy the document with the XML Formatter.

Frequently asked questions

How do I decode a SAMLResponse?
Copy the SAMLResponse form value, URL-decode it if it contains %XX sequences, then paste it here. The decoded XML shows the assertion and its attributes.
Why does my SAMLRequest decode to binary?
Redirect-binding requests are DEFLATE-compressed before Base64 encoding. Inflate the decoded bytes, for example with a raw DEFLATE decompressor.
Does the tool verify SAML signatures?
No. It only decodes and displays the XML. Signature validation must be done by your service provider software with the identity provider’s certificate.
Can I decode encrypted assertions?
You will see the EncryptedAssertion XML, but its contents remain encrypted. Only the service provider’s private key can decrypt them.

Last updated October 3, 2026

Related tools

XML to Base64 Convert XML to a Base64 string online. UTF-8 safe; paste text or upload a .xml file. Base64 to ASCII Decode Base64 to ASCII text; bytes outside printable ASCII are shown as \xHH escapes. Base64 to Binary Decode Base64 and show the underlying bytes as binary (8-bit) byte values. Base64 to CSV Decode a Base64 string back to CSV with syntax highlighting. Base64 to Hex Decode Base64 and show the underlying bytes as hexadecimal byte values. Base64 to Image Preview and download images from Base64 strings or data URIs. Detects PNG, JPEG, GIF, WebP, BMP, ICO and SVG. Base64 to YAML Decode a Base64 string back to YAML with syntax highlighting. Binary to Base64 Convert binary (8-bit) byte values to a Base64 string. Separate the bytes with spaces, commas or line breaks, or paste one continuous bit string. CSV to Base64 Convert CSV to a Base64 string online. UTF-8 safe; paste text or upload a .csv file. File to Base64 Convert any file — PDF, ZIP, font, image or document — to Base64 or a data URI in your browser. Hex to Base64 Convert hexadecimal byte values to a Base64 string. Separators and prefixes are handled automatically. Image to Base64 Convert PNG, JPG, GIF, WebP, SVG or ICO images to Base64 data URIs for HTML, CSS and JSON.