Your files stay on your device

SAML response inspector

Paste a Base64 SAMLResponse or raw XML and read assertion fields, attributes, conditions, and signature facts locally. Optional signature check against the embedded or pasted key.
SAML responseInspect

- No entity resolution, no external DTD/schema fetch: nothing loads over the network, so no XXE surface and no data leaving.
- No deflated (Redirect-binding) responses: the deflate+base64 form needs DecompressionStream of raw deflate; paste the POST-binding Base64 or XML.
- A verified signature proves the document was not changed since signing, WHO signed it is a certificate-chain question this page cannot answer offline.
- A pasted assertion is a bearer credential. It lives in this tab’s memory for the session, nothing is stored or sent, and a browser tab cannot guarantee the memory is zeroized after you leave.
Paste, drop, or type to begin. Everything stays on this device.

More web & auth tools

- Certificate & CSR (/web/certificate)
- JWK / JWKS (/web/jwk)
All web & auth tools (/web)

Canonical HTML: https://nutter.tools/web/saml/
Markdown version: https://nutter.tools/web/saml/index.md
Plain-text version: https://nutter.tools/web/saml/index.txt
Agent index: https://nutter.tools/llms.txt