Online Tools

Client-side SAML developer tools that run entirely in your browser — no data is sent to any server. Older versions of these tools are also available at samltool.com.

Base64 Encode / Decode

Encode a string to Base64 or decode a Base64-encoded string. Supports full Unicode.

URL Encode / Decode

Encode special characters for URLs, or decode a URL-encoded string.

GZIP Encode / Decode

Compress a string with GZIP and Base64-encode the result, or Base64-decode and GZIP-decompress.

Deflate + Base64 / Base64 + Inflate

Compress (deflate) and Base64-encode a SAML message, or Base64-decode and inflate. Used in SAML HTTP-Redirect binding.

XML Pretty Print

Format and indent XML documents for readability.

Format X.509 Certificate / Private Key

Normalize PEM-encoded certificates or private keys. Fixes line wrapping (64 chars) and ensures proper headers.

Calculate X.509 Fingerprint

Compute the fingerprint of a PEM-encoded X.509 certificate using SHA-1, SHA-256, SHA-384, or SHA-512 via the Web Crypto API.

Encrypt XML

Encrypt a node from a SAML message using XML Encryption (AES-CBC + RSA-OAEP). Paste the full XML, provide the recipient's X.509 certificate, and specify which node to encrypt (default: saml:Assertion). The encrypted node is replaced in-place inside the full XML. Runs entirely in your browser — no data is sent to any server.

Decrypt XML

Decrypt an encrypted node from a SAML message. Paste the XML containing xenc:EncryptedData and the matching private key. The decrypted node replaces the encrypted wrapper in the full XML output. Accepts PKCS#8 (BEGIN PRIVATE KEY) and PKCS#1 (BEGIN RSA PRIVATE KEY) PEM formats.

SAML Attribute Extractor

Extract the NameID and attributes from a SAML Response or Assertion. Accepts raw XML, Base64, or Base64 + Deflated input. If the assertion or NameID is encrypted, provide the SP private key to decrypt it first.

🔒
Private key value is not stored
Any private key value that you enter or we generate is not stored on this site or on the OneLogin platform. Also, notice that this tool is provided via an HTTPS URL to ensure that private keys cannot be stolen.

For extra security, please do not use production keys on this site.

Build IdP Metadata

Generate SAML Identity Provider metadata XML from a form.

Build SP Metadata

Generate SAML Service Provider metadata XML from a form.


Generate Self-Signed Certificate

Generate a self-signed X.509 certificate and RSA private key entirely in the browser using the Web Crypto API.

🔒
Private key value is not stored
Any private key value that you enter or we generate is not stored on this site or on the OneLogin platform. Also, notice that this tool is provided via an HTTPS URL to ensure that private keys cannot be stolen.

For extra security, please do not use production keys on this site.

Validate SAML AuthnRequest

Structural validation of a SAML 2.0 AuthnRequest. Checks required elements, attributes, and namespaces. Optionally verifies the XML Signature with a certificate. Accepts raw XML, Base64, or Base64 + Deflated input.

Validate SAML Response

Structural and temporal validation of a SAML 2.0 Response. Checks Status, Assertion, Conditions, timestamps, and audience. Optionally verifies the XML Signature. Accepts raw XML or Base64.

Validate SAML Logout Request

Structural validation of a SAML 2.0 LogoutRequest. Optionally verifies the XML Signature. Accepts raw XML, Base64, or Base64 + Deflated input.

Validate SAML Logout Response

Structural validation of a SAML 2.0 LogoutResponse. Optionally verifies the XML Signature. Accepts raw XML or Base64.

Sign XML (Enveloped Signature)

Sign any SAML XML (AuthnRequest, Response, LogoutRequest, LogoutResponse, Metadata) with an enveloped XML Signature using Exclusive XML Canonicalization and Web Crypto. Private key never leaves your browser.

Build HTTP-Redirect Binding Signature

Build or verify a SAML HTTP-Redirect binding URL. Deflates and Base64-encodes the SAML message, then signs the query string (SAMLRequest/SAMLResponse + RelayState + SigAlg) per the SAML 2.0 Bindings spec §3.4.4.1.

Validate XML Against XSD Schema

Validate XML against an XSD schema using libxml2 compiled to WebAssembly (xmllint-wasm). Runs entirely in your browser — your data never leaves the page. The WASM engine (~760 KB) loads on first use.
Note: Requires a browser with module Worker support (Chrome, Edge, Safari). Firefox is not yet supported.