Base64 to XML

What the Base64 to XML tool does

XML turns up Base64-wrapped more often than people expect, especially in the world of enterprise systems talking to each other. This tool pulls it back out. Paste the Base64 in, press Convert, and the XML inside comes back as readable text, tags and all.

It is the same decoding step as the plain Base64 decoder, pointed at the case where what was packed away is an XML document.

How to use it

1. Paste the Base64. Drop the encoded string into the box, or upload a text file holding it.
2. Press Convert. The decoded XML appears below, ready to Copy or Download.

Clear empties both boxes for a fresh start.

Where Base64-wrapped XML comes from

Like JSON, XML is text, so the reason it gets Base64-wrapped is to move it safely. An XML document is dense with angle brackets, quotes, and slashes, all of which cause trouble inside a URL, an HTML form field, or an HTTP header. Flattening the whole document into Base64 turns it into one clean run of safe characters that can be posted, redirected, or stored anywhere without a single tag getting mangled, and then unwrapped at the destination. That is why so much machine-to-machine XML travels this way.

The big one: SAML and single sign-on

If you are decoding Base64 XML, the odds are good it is a SAML message. SAML is the language behind a lot of corporate single sign-on, the handshake that lets you log into one company system and quietly get into the others. Those SAML assertions and responses are XML, and they are Base64-encoded so they can ride along inside a browser redirect or a form post between the identity provider and the application. When a sign-on flow breaks, decoding that Base64 blob back to XML is how you actually see what was sent, which attributes, which destination, which timestamps. The same goes for SOAP, the older XML-based style of web service, whose messages and attachments often travel encoded too. For both, this tool is the first step to seeing what is really inside.

How it works

Underneath it is a plain Base64 decode. The tool reads the encoded string, rebuilds the original bytes, and shows them as text, so XML going in is XML coming out. The actual decoding mechanics, four characters rebuilt into three bytes at a time, are the same as on the Base64 Decode page, where they are walked through in full.

After decoding: reading the XML

What comes back is the raw XML, and it often arrives as one continuous block with no line breaks, because that is how it was stored before encoding. It is still valid XML, just hard on the eyes. To see it properly nested and indented, or to check that it is well formed, paste the decoded text into a dedicated XML formatter. This tool gets the document out of its Base64 wrapper. Laying it out and validating it is the natural next step, in a tool meant for that.

Questions people ask

How do I convert a Base64 string to XML?

Paste the Base64 into the box and press Convert. The tool decodes it and shows the XML document that was packed inside, ready to copy.

Can I use this to inspect a SAML response?

Yes. A SAML response is XML that has been Base64-encoded for transit, so decoding it here reveals the underlying assertion, its attributes, destination, and timestamps. It is a common step when debugging single sign-on.

The XML came out as one long block. How do I make it readable?

That is expected and still valid. To see it indented and nested, or to confirm it is well formed, paste the decoded text into an XML formatter. This tool handles the decoding step only.

What if the result is not XML?

Then the Base64 held something else, plain text, JSON, or binary data. The decoding is always faithful, but XML only appears if XML was what was encoded.

References

1. Josefsson, S. (2006). RFC 4648: The Base16, Base32, and Base64 Data Encodings. Internet Engineering Task Force (IETF). https://www.rfc-editor.org/rfc/rfc4648
2. World Wide Web Consortium (W3C), Extensible Markup Language (XML) 1.0. https://www.w3.org/TR/xml/