Running on your device · 0 bytes uploaded
SAML response inspector
Paste a Base64 SAMLResponse or raw XML — assertion fields, attributes, conditions, and signature facts, read locally. Optional signature check against the embedded or pasted key.
- No entity resolution, no external DTD/schema fetch — nothing loads over the network, so no XXE surface and no data leaving.
- No deflated (Redirect-binding) responses: the deflate+base64 form needs DecompressionStream of raw deflate; paste the POST-binding Base64 or XML.
- A verified signature proves the document was not changed since signing — WHO signed it is a certificate-chain question this page cannot answer offline.
- A pasted assertion is a bearer credential — it lives in this tab’s memory for the session, nothing is stored or sent, and a browser tab cannot guarantee the memory is zeroized after you leave.
Nothing in yet
Paste, drop, or type to begin. Everything stays on this device.
paste a SAML response