S

SAML Debug Console

Decode, inspect and verify a SAMLResponse

Paste a SAMLResponse (base64 or raw XML), or point your IdP's ACS URL at this page and it will fill in automatically

Expected IdP signing certificate (optional)

Paste the certificate from your IdP metadata. It is compared with the one embedded in the signature, and used to verify signatures that carry no KeyInfo.

Verification happens entirely in this browser tab: the pasted response is never sent anywhere, and the Worker only echoes back what your IdP posted to it. A valid signature here proves the XML was signed by the key in the embedded certificate — it does not prove that certificate is the one your SP trusts. Compare the thumbprint with your IdP metadata for that.