happytails.ai

SAML response inspector

Open SAML response inspector on Happytails.ai. This view has the same page content and links, with explicit tool capabilities. Read the processing notes before using a tool.

Tool capabilities

{
  "id": "saml-response-inspector",
  "category": "developer-tools",
  "built": true,
  "requirements": "Input up to 1000000 characters, decoded messages up to 2000000 bytes, 64 levels and 20000 elements. Decoding runs locally in a background worker. Download a JSON report, plus the decoded XML when masking is off.",
  "implementation": {
    "fields": [
      {
        "key": "time",
        "label": "Check time windows at (UTC or Unix seconds)",
        "value": "2026-10-16T12:00:00Z",
        "type": "text"
      },
      {
        "key": "maskPersonalData",
        "label": "Mask names, emails and attribute values",
        "value": true,
        "type": "checkbox"
      }
    ],
    "registrationFamily": "crypto-formats-signed-envelopes",
    "inputMaxLength": 1000000,
    "inputErrorCode": "CRYPTO_FORMATS_SIGNED_ENVELOPES_TOO_LONG_SAML",
    "note": "Decoded in your browser; nothing is sent to your identity provider. Up to 1000000 characters.",
    "experience": {
      "automatic": false,
      "single": false,
      "inputMaxLength": 1000000,
      "inputMode": "text",
      "label": "SAML message",
      "placeholder": "PHNhbWxwOlJlc3BvbnNlIC4uLg==",
      "help": "Paste the SAMLResponse value, a redirect URL or the XML. Up to 1,000,000 characters. Review the settings before running.",
      "helpParts": [
        "Paste the SAMLResponse value, a redirect URL or the XML.",
        "Up to 1,000,000 characters.",
        "Review the settings before running."
      ],
      "action": null
    },
    "mode": "explicit",
    "interactive": false
  },
  "execution": "Browser interface",
  "api": null,
  "browser_agent": {
    "supported": true,
    "name": "run_current_tool",
    "discovery": "WebMCP on the human page in a supporting browser",
    "verification": "See audit/API-AUDIT.md; availability is not verification"
  }
}

Page guide

Decode a SAML response or request in your browser and read its issuer, status, subject, conditions, audience and attributes. Personal data is masked by default, and nothing is sent anywhere.

How to use SAML response inspector
  1. Paste the SAMLResponse value, the whole redirect URL or the XML.
  2. Enter the time to check the validity windows against.
  3. Keep masking on if you plan to share the report.
  4. Run the tool and review the assertion details.

Useful next steps

Base64 encoder decoderURL encoder decoderJWT decoder

Bindings

HTTP-POST messages are Base64; HTTP-Redirect messages are raw DEFLATE, then Base64 and URL encoding, as defined in the SAML 2.0 bindings specification (OASIS, March 2005). The tool detects which one you pasted and also accepts plain XML.

Safe parsing

XML with a DOCTYPE or entity declarations is refused before parsing, so entity expansion and external entity attacks cannot run. Depth, element count and size are bounded, and any parser warning stops the run.

What it shows and does not check

Time windows are compared with the time you enter, with NotOnOrAfter exclusive. Times are read as xs:dateTime in UTC, as SAML core section 1.3.3 requires: a time without a zone is UTC, an offset such as +02:00 is applied, and any other form is reported as unreadable-time. Signatures are listed, not verified; use the SAML signature verifier with your identity provider certificate for that. Encrypted assertions are counted but not decrypted.