How to use
What this is
Paste a SAMLResponse/SAMLRequest — the full URL of a Redirect binding, the base64 value of a POST binding, or the already-decoded XML — and it decodes and audits it: signature, algorithms, expiry, audience, and the classic XML Signature Wrapping (XSW) attack pattern. Nothing leaves your browser.
What this does NOT do
This audits the STRUCTURE of the message, not the cryptographic validity of the signature (that would need the IdP's public certificate, which isn't pasted here). A signature that's present and uses a good algorithm can still be invalid if the certificate doesn't match — that's checked by your service provider, not this tool.
What is XSW?
XML Signature Wrapping: an attacker injects a new element (with the same ID as the original, or a different one) so that the code that validates the signature looks at one thing and the code that reads the data looks at another. It still breaks SSO implementations in production — PortSwigger documented it again in 2025.
