OAuth 2.0, OIDC & PKCE Debugger
Security Network on demand
SAML SSO Debugger
Local SAML evidenceDecode SAML messages and HAR evidence, evaluate assertions, inspect metadata, verify signatures, and compare configurations.
Evidence is decoded locally and never replayed. Treat every field as untrusted until the expected signature and protocol checks pass on your server.
Ready to inspect SAML evidence
Paste or open captured SAML evidence to decode assertions, test expected values, inspect certificates and compare metadata.
How to use it
- 01
Load captured evidence
Paste raw XML, Base64, an encoded SAML parameter, a Redirect URL, or open a HAR capture without replaying it.
- 02
Evaluate protocol data
Inspect messages, assertions, subjects, attributes, audience, destination, recipient, request correlation and time windows with explicit skew.
- 03
Verify and compare
Inspect certificates and endpoints, verify supported signatures, compare metadata rotation, and export a redacted diagnostic report.
Frequently asked questions
Does decoding a SAML response prove it is valid?
No. Treat decoded XML as untrusted evidence. Production service providers must securely validate the expected signed element, trust chain, algorithms, conditions, destination and replay state.
Which bindings can be decoded?
The tool accepts HTTP-POST Base64 values, HTTP-Redirect query values with raw DEFLATE where applicable, raw XML, URLs, form bodies and SAML requests found in HAR files.
Can I verify every XML signature profile?
No browser debugger can replace a hardened SAML implementation. The tool verifies signatures supported by its Web Crypto/XMLDSig engine and clearly reports unsupported or failed cases.
Is assertion data uploaded?
No. Decoding, checks, certificate inspection and report generation run in the browser. Reports redact subjects, attributes, session identifiers, relay state and signature material.
Related tools
Keep working with other focused browser utilities.