How does the XML URL Decoder automatically detect input formats?
The engine inspects your input string and automatically distinguishes between standard Percent-Encoded XML (%3C...), SAML 2.0 HTTP-Redirect payloads (Deflate + Base64URL), Full API Request URLs containing query parameters, and plain Base64URL payloads.
How does SAML 2.0 HTTP-Redirect Un-binding work?
SAML 2.0 redirect requests are passed in SAMLRequest or SAMLResponse parameters. The decoder reverses URL percent-encoding, decodes Base64URL bytes, decompresses raw DEFLATE bytes (RFC 1951), and formats the extracted SAML XML assertion.
Can I paste a full API request URL containing encoded XML?
Yes! You can paste an entire HTTP request URL (e.g. https://idp.example.com/sso?SAMLRequest=fZB...). The decoder automatically extracts the query parameter value and decodes it.
Does the tool handle double-encoded URLs?
Yes. The decoder performs recursive multi-pass percent un-escaping, resolving double or triple encoded strings (%253C -> %3C -> <) automatically.
Does it automatically pretty-print and format the decoded XML?
Yes. If the decoded output is valid XML, the tool automatically pretty-prints and indents the tag structure. You can toggle pretty-printing on or off using the controls bar.
Is there a batch mode for decoding multiple encoded strings?
Yes. Switch to "⚡ Multi-line Batch" mode to decode lists of encoded XML payloads, URLs, or SAML parameters line-by-line simultaneously.
What is the DOM Render Sandbox view?
The DOM Render Sandbox tab displays a clean, visual representation of the decoded XML element tree, helping you inspect tag hierarchies visually.
Is my XML payload sent to any server for decoding or decompression?
No. 100% of decoding, Base64 un-binding, DEFLATE inflation, and DOM formatting runs locally inside your browser using JavaScript Web Workers. Zero payload data leaves your device.
What is the difference between percent decoding and SAML un-binding?
Percent decoding converts %3C back to <. SAML un-binding additionally decompress raw DEFLATE bytes that SAML Identity Providers use to shrink authentication requests in HTTP GET query parameters.
How do I switch back to XML URL encoding?
Click the "Switch to Encode" link or navigate to /encode-decode/xml-url-encode to URL-encode raw XML payloads into percent-encoded or SAML 2.0 formats.