Base64 to XML: Decode XML Payloads

How to decode Base64 to XML

1. Paste the Base64 into Input · Base64. The page loads with a small sample.
2. The XML appears in Output · text. Looks like XML in the status line confirms the content starts like an XML document.
3. If the output shows gaps between letters or a binary warning, the XML is UTF-16: set Charset to UTF-16LE, or to Auto-detect if it starts with a byte order mark.
4. Copy output copies the text. Download saves the original bytes as decoded.xml.

The sample PD94bWwgdmVyc2lvbj0iMS4wIj8+Cjxub3RlPjx0bz55b3U8L3RvPjxib2R5PkhlbGxvPC9ib2R5Pjwvbm90ZT4= decodes to:

<?xml version="1.0"?>
<note><to>you</to><body>Hello</body></note>

The reverse is XML to Base64.

Recognizing encoded XML

Because XML starts with <, its Base64 starts with P, and the next characters reveal more:

A value that should be SAML but does not start with P is usually compressed XML; how to inflate it is explained below.

UTF-16 and other encodings

Most XML is UTF-8, which the decoder assumes. Two cases need a different Charset:

• UTF-16 documents, common from Windows tools and .NET, have a zero byte next to every ASCII character. Decoded as UTF-8 they look like binary data, and the tool says so. With Auto-detect or UTF-16LE the full text appears, starting with <?xml version="1.0" encoding="UTF-16"?>. Download keeps the bytes but names the file decoded.bin, so rename it to .xml.
• Latin-1 or Windows-1252 documents declare encoding="ISO-8859-1" or similar. Accented letters show as � in UTF-8 mode; pick the declared charset to read them.

The XML declaration inside the output tells you which charset the author intended. An XML parser reading the downloaded file uses that declaration, so the file is fine even if the on-screen preview needed a manual charset choice.

Where Base64 XML comes from

SAML is the most frequent source: identity providers post the SAMLResponse to your application as Base64-encoded XML, and copying it from the browser’s network tab is the usual way to debug a login. SOAP services and e-invoicing platforms return documents and attachments as Base64 fields. Email can carry XML attachments as MIME Base64 parts, which the email decoder extracts.

For SAML SAMLRequest values from redirect URLs, the XML was compressed with raw DEFLATE before encoding, so plain Base64 decoding yields binary. The gzip Base64 decoder inflates it. The escapes %2B, %2F and %3D are decoded automatically; for a fully URL-encoded value, use the URL decoder first.

Base64 to XML in code

Pass the decoded bytes to the XML parser without turning them into a string first, so it reads the encoding from the declaration itself:

import base64
import xml.etree.ElementTree as ET

s = "PD94bWwgdmVyc2lvbj0iMS4wIj8+Cjxub3RlPjx0bz55b3U8L3RvPjxib2R5PkhlbGxvPC9ib2R5Pjwvbm90ZT4="
root = ET.fromstring(base64.b64decode(s))
root.find("body").text   # 'Hello'

// Browser
const s = "PD94bWwgdmVyc2lvbj0iMS4wIj8+Cjxub3RlPjx0bz55b3U8L3RvPjxib2R5PkhlbGxvPC9ib2R5Pjwvbm90ZT4=";
const bytes = Uint8Array.from(atob(s), c => c.charCodeAt(0));
const doc = new DOMParser().parseFromString(new TextDecoder().decode(bytes), "application/xml");

For UTF-16 or Latin-1 XML in the browser, pass the right label to TextDecoder. More in Base64 in Python and Base64 in JavaScript.

FAQ