{
  "title": "SAML response inspector",
  "human_url": "https://happytails.ai/en/developer-tools/saml-response-inspector/",
  "agent_url": "https://happytails.ai/agents/en/developer-tools/saml-response-inspector/",
  "language": "en",
  "markdown_url": "https://happytails.ai/en/developer-tools/saml-response-inspector.md",
  "content": "SAML response inspector\nDecode a SAML response or request in your browser and read its issuer, status, subject, conditions, audience and attributes. Personal data is masked by default, and nothing is sent anywhere.\nHow can we improve this tool?\nReport a problem or share an idea.\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\nHow to use SAML response inspector\nPaste the SAMLResponse value, the whole redirect URL or the XML.\nEnter the time to check the validity windows against.\nKeep masking on if you plan to share the report.\nRun the tool and review the assertion details.\nUseful next steps\nBase64 encoder decoder\nURL encoder decoder\nJWT decoder\nBindings\nHTTP-POST messages are Base64; HTTP-Redirect messages are raw DEFLATE, then Base64 and URL encoding, as defined in the SAML 2.0 bindings specification (OASIS, March 2005). The tool detects which one you pasted and also accepts plain XML.\nSafe parsing\nXML with a DOCTYPE or entity declarations is refused before parsing, so entity expansion and external entity attacks cannot run. Depth, element count and size are bounded, and any parser warning stops the run.\nWhat it shows and does not check\nTime windows are compared with the time you enter, with NotOnOrAfter exclusive. Times are read as xs:dateTime in UTC, as SAML core section 1.3.3 requires: a time without a zone is UTC, an offset such as +02:00 is applied, and any other form is reported as unreadable-time. Signatures are listed, not verified; use the SAML signature verifier with your identity provider certificate for that. Encrypted assertions are counted but not decrypted.",
  "content_format": "text/plain",
  "visibility": "public",
  "links": [
    {
      "name": "Base64 encoder decoder",
      "url": "https://happytails.ai/en/developer-tools/base64-encoder-decoder/"
    },
    {
      "name": "URL encoder decoder",
      "url": "https://happytails.ai/en/developer-tools/url-encoder-decoder/"
    },
    {
      "name": "JWT decoder",
      "url": "https://happytails.ai/en/developer-tools/jwt-decoder/"
    }
  ],
  "tool": {
    "id": "saml-response-inspector",
    "category": "developer-tools",
    "built": true,
    "requirements": "Input up to 1000000 characters, decoded messages up to 2000000 bytes, 64 levels and 20000 elements. Decoding runs locally in a background worker. Download a JSON report, plus the decoded XML when masking is off.",
    "implementation": {
      "fields": [
        {
          "key": "time",
          "label": "Check time windows at (UTC or Unix seconds)",
          "value": "2026-10-16T12:00:00Z",
          "type": "text"
        },
        {
          "key": "maskPersonalData",
          "label": "Mask names, emails and attribute values",
          "value": true,
          "type": "checkbox"
        }
      ],
      "registrationFamily": "crypto-formats-signed-envelopes",
      "inputMaxLength": 1000000,
      "inputErrorCode": "CRYPTO_FORMATS_SIGNED_ENVELOPES_TOO_LONG_SAML",
      "note": "Decoded in your browser; nothing is sent to your identity provider. Up to 1000000 characters.",
      "experience": {
        "automatic": false,
        "single": false,
        "inputMaxLength": 1000000,
        "inputMode": "text",
        "label": "SAML message",
        "placeholder": "PHNhbWxwOlJlc3BvbnNlIC4uLg==",
        "help": "Paste the SAMLResponse value, a redirect URL or the XML. Up to 1,000,000 characters. Review the settings before running.",
        "action": null
      },
      "mode": "explicit",
      "interactive": false
    },
    "execution": "Browser interface",
    "api": null,
    "browser_agent": {
      "supported": true,
      "name": "run_current_tool",
      "discovery": "WebMCP on the human page in a supporting browser",
      "verification": "See audit/API-AUDIT.md; availability is not verification"
    }
  },
  "markdown": "# SAML response inspector\n\n- Human page: https://happytails.ai/en/developer-tools/saml-response-inspector/\n- Markdown: https://happytails.ai/en/developer-tools/saml-response-inspector.md\n- Structured JSON: https://happytails.ai/agents/en/developer-tools/saml-response-inspector/index.json\n- Visibility: public\n\n## Tool capabilities\n\n| Property | Value |\n| --- | --- |\n| Tool ID | `saml-response-inspector` |\n| Category | developer-tools |\n| Implementation | Registered implementation. Registration alone is not a production-quality guarantee. |\n| Browser execution | Use the visible action or interactive controls. |\n| Browser processing | Browser; see tool notes for network behavior. |\n| HTTP API | Not callable through HTTP. |\n| Browser-agent interface | run_current_tool |\n\n### Implementation notes\n\nDecoded in your browser; nothing is sent to your identity provider. Up to 1000000 characters.\n\n### Inputs and settings\n\nText input: SAML message.\n\nExample or placeholder shown in the interface (not a validated fixture):\n\n```text\nPHNhbWxwOlJlc3BvbnNlIC4uLg==\n```\n\nPaste the SAMLResponse value, a redirect URL or the XML. Up to 1,000,000 characters. Review the settings before running.\n\n| Setting | Meaning | Control type | Default | Constraints |\n| --- | --- | --- | --- | --- |\n| `time` | Check time windows at (UTC or Unix seconds) | text | \"2026-10-16T12:00:00Z\" |  |\n| `maskPersonalData` | Mask names, emails and attribute values | checkbox | true |  |\n\n### Browser-agent workflow\n\n1. Open the human page in a browser that supports WebMCP.\n2. Discover the interface exposed by that page; use its actual schema.\n3. Select files on the page first when the tool requires files.\n4. Call `run_current_tool` with valid input and settings.\n5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links.\n\nCalls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution.\n\n### Planning specification\n\nInput up to 1000000 characters, decoded messages up to 2000000 bytes, 64 levels and 20000 elements. Decoding runs locally in a background worker. Download a JSON report, plus the decoded XML when masking is off.\n\nThis describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support.\n\n### Complete machine-readable capability record\n\n```json\n{\n  \"id\": \"saml-response-inspector\",\n  \"category\": \"developer-tools\",\n  \"built\": true,\n  \"requirements\": \"Input up to 1000000 characters, decoded messages up to 2000000 bytes, 64 levels and 20000 elements. Decoding runs locally in a background worker. Download a JSON report, plus the decoded XML when masking is off.\",\n  \"implementation\": {\n    \"fields\": [\n      {\n        \"key\": \"time\",\n        \"label\": \"Check time windows at (UTC or Unix seconds)\",\n        \"value\": \"2026-10-16T12:00:00Z\",\n        \"type\": \"text\"\n      },\n      {\n        \"key\": \"maskPersonalData\",\n        \"label\": \"Mask names, emails and attribute values\",\n        \"value\": true,\n        \"type\": \"checkbox\"\n      }\n    ],\n    \"registrationFamily\": \"crypto-formats-signed-envelopes\",\n    \"inputMaxLength\": 1000000,\n    \"inputErrorCode\": \"CRYPTO_FORMATS_SIGNED_ENVELOPES_TOO_LONG_SAML\",\n    \"note\": \"Decoded in your browser; nothing is sent to your identity provider. Up to 1000000 characters.\",\n    \"experience\": {\n      \"automatic\": false,\n      \"single\": false,\n      \"inputMaxLength\": 1000000,\n      \"inputMode\": \"text\",\n      \"label\": \"SAML message\",\n      \"placeholder\": \"PHNhbWxwOlJlc3BvbnNlIC4uLg==\",\n      \"help\": \"Paste the SAMLResponse value, a redirect URL or the XML. Up to 1,000,000 characters. Review the settings before running.\",\n      \"action\": null\n    },\n    \"mode\": \"explicit\",\n    \"interactive\": false\n  },\n  \"execution\": \"Browser interface\",\n  \"api\": null,\n  \"browser_agent\": {\n    \"supported\": true,\n    \"name\": \"run_current_tool\",\n    \"discovery\": \"WebMCP on the human page in a supporting browser\",\n    \"verification\": \"See audit/API-AUDIT.md; availability is not verification\"\n  }\n}\n```\n\n## Page guide\n\nDecode a SAML response or request in your browser and read its issuer, status, subject, conditions, audience and attributes. Personal data is masked by default, and nothing is sent anywhere.\n\nHow can we improve this tool?\n\nReport a problem or share an idea.\n\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\n\n### How to use SAML response inspector\n\n1. Paste the SAMLResponse value, the whole redirect URL or the XML.\n2. Enter the time to check the validity windows against.\n3. Keep masking on if you plan to share the report.\n4. Run the tool and review the assertion details.\n\n## Useful next steps\n\n- [Base64 encoder decoder](https://happytails.ai/en/developer-tools/base64-encoder-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/base64-encoder-decoder.md))\n\n- [URL encoder decoder](https://happytails.ai/en/developer-tools/url-encoder-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/url-encoder-decoder.md))\n\n- [JWT decoder](https://happytails.ai/en/developer-tools/jwt-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/jwt-decoder.md))\n\n## Bindings\n\nHTTP-POST messages are Base64; HTTP-Redirect messages are raw DEFLATE, then Base64 and URL encoding, as defined in the SAML 2.0 bindings specification (OASIS, March 2005). The tool detects which one you pasted and also accepts plain XML.\n\n### Safe parsing\n\nXML with a DOCTYPE or entity declarations is refused before parsing, so entity expansion and external entity attacks cannot run. Depth, element count and size are bounded, and any parser warning stops the run.\n\n### What it shows and does not check\n\nTime windows are compared with the time you enter, with NotOnOrAfter exclusive. Times are read as xs:dateTime in UTC, as SAML core section 1.3.3 requires: a time without a zone is UTC, an offset such as +02:00 is applied, and any other form is reported as unreadable-time. Signatures are listed, not verified; use the SAML signature verifier with your identity provider certificate for that. Encrypted assertions are counted but not decrypted.\n"
}