{
  "title": "SAML signature verifier",
  "human_url": "https://happytails.ai/en/developer-tools/saml-signature-verifier/",
  "agent_url": "https://happytails.ai/agents/en/developer-tools/saml-signature-verifier/",
  "language": "en",
  "markdown_url": "https://happytails.ai/en/developer-tools/saml-signature-verifier.md",
  "content": "SAML signature verifier\nCheck the XML signatures in a SAML response in your browser against your identity provider certificate. See exactly which element each signature covers and whether the response shows signs of a signature wrapping attack.\nHow can we improve this tool?\nReport a problem or share an idea.\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\nHow to use SAML signature verifier\nPaste the SAMLResponse value or the XML.\nPaste the signing certificate from your identity provider metadata.\nRun the tool and read the verdict, the covered elements and the wrapping checks.\nUseful next steps\nSSL checker\nBase64 encoder decoder\nJWT decoder\nMethod\nEach ds:Signature is checked under W3C XML Signature 1.1: one reference to the ID of the element that contains the signature, exactly two transforms (the enveloped signature transform, then Exclusive XML Canonicalization 1.0), the digest, and the RSA or ECDSA signature over the canonical SignedInfo with SHA-256, SHA-384 or SHA-512. SHA-1, inclusive canonicalization and other transforms are refused. A reference with only the enveloped signature transform is refused too, because XML Signature then canonicalizes it inclusively.\nWrapping defences\nIDs must be unique, every signature must sit inside the element it signs, signed elements must be the Response or an Assertion directly inside it, there must be exactly one assertion, and every assertion must be covered by a valid signature. The report names the exact covered element so you can compare it with what your service provider reads.\nWhat it does not check\nAudience, recipient, time conditions and replay are the service provider's job, and the certificate's own validity dates are only reported. Nothing is fetched; only the certificate you paste is trusted.",
  "content_format": "text/plain",
  "visibility": "public",
  "links": [
    {
      "name": "SSL checker",
      "url": "https://happytails.ai/en/web-tools/ssl-checker/"
    },
    {
      "name": "Base64 encoder decoder",
      "url": "https://happytails.ai/en/developer-tools/base64-encoder-decoder/"
    },
    {
      "name": "JWT decoder",
      "url": "https://happytails.ai/en/developer-tools/jwt-decoder/"
    }
  ],
  "tool": {
    "id": "saml-signature-verifier",
    "category": "developer-tools",
    "built": true,
    "requirements": "Input up to 1000000 characters, certificate up to 20000 characters, at most 20 signatures. Verification runs locally in a background worker in your browser. Download a JSON report.",
    "implementation": {
      "fields": [
        {
          "key": "certificate",
          "label": "Identity provider signing certificate",
          "value": "",
          "type": "textarea",
          "help": "PEM or Base64 X.509 certificate from the identity provider metadata."
        }
      ],
      "registrationFamily": "crypto-formats-signed-envelopes",
      "inputMaxLength": 1000000,
      "inputErrorCode": "CRYPTO_FORMATS_SIGNED_ENVELOPES_TOO_LONG_SAML",
      "note": "Verified in your browser against the certificate you paste. Up to 1000000 characters.",
      "experience": {
        "automatic": false,
        "single": false,
        "inputMaxLength": 1000000,
        "inputMode": "text",
        "label": "SAML response",
        "placeholder": "PHNhbWxwOlJlc3BvbnNlIC4uLg==",
        "help": "Paste the SAMLResponse value or the XML. Up to 1,000,000 characters. Review the settings before running.",
        "action": null
      },
      "mode": "explicit",
      "interactive": false
    },
    "execution": "Browser interface",
    "api": null,
    "browser_agent": {
      "supported": true,
      "name": "run_current_tool",
      "discovery": "WebMCP on the human page in a supporting browser",
      "verification": "See audit/API-AUDIT.md; availability is not verification"
    }
  },
  "markdown": "# SAML signature verifier\n\n- Human page: https://happytails.ai/en/developer-tools/saml-signature-verifier/\n- Markdown: https://happytails.ai/en/developer-tools/saml-signature-verifier.md\n- Structured JSON: https://happytails.ai/agents/en/developer-tools/saml-signature-verifier/index.json\n- Visibility: public\n\n## Tool capabilities\n\n| Property | Value |\n| --- | --- |\n| Tool ID | `saml-signature-verifier` |\n| Category | developer-tools |\n| Implementation | Registered implementation. Registration alone is not a production-quality guarantee. |\n| Browser execution | Use the visible action or interactive controls. |\n| Browser processing | Browser; see tool notes for network behavior. |\n| HTTP API | Not callable through HTTP. |\n| Browser-agent interface | run_current_tool |\n\n### Implementation notes\n\nVerified in your browser against the certificate you paste. Up to 1000000 characters.\n\n### Inputs and settings\n\nText input: SAML response.\n\nExample or placeholder shown in the interface (not a validated fixture):\n\n```text\nPHNhbWxwOlJlc3BvbnNlIC4uLg==\n```\n\nPaste the SAMLResponse value or the XML. Up to 1,000,000 characters. Review the settings before running.\n\n| Setting | Meaning | Control type | Default | Constraints |\n| --- | --- | --- | --- | --- |\n| `certificate` | Identity provider signing certificate | textarea | \"\" |  |\n\n### Browser-agent workflow\n\n1. Open the human page in a browser that supports WebMCP.\n2. Discover the interface exposed by that page; use its actual schema.\n3. Select files on the page first when the tool requires files.\n4. Call `run_current_tool` with valid input and settings.\n5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links.\n\nCalls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution.\n\n### Planning specification\n\nInput up to 1000000 characters, certificate up to 20000 characters, at most 20 signatures. Verification runs locally in a background worker in your browser. Download a JSON report.\n\nThis describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support.\n\n### Complete machine-readable capability record\n\n```json\n{\n  \"id\": \"saml-signature-verifier\",\n  \"category\": \"developer-tools\",\n  \"built\": true,\n  \"requirements\": \"Input up to 1000000 characters, certificate up to 20000 characters, at most 20 signatures. Verification runs locally in a background worker in your browser. Download a JSON report.\",\n  \"implementation\": {\n    \"fields\": [\n      {\n        \"key\": \"certificate\",\n        \"label\": \"Identity provider signing certificate\",\n        \"value\": \"\",\n        \"type\": \"textarea\",\n        \"help\": \"PEM or Base64 X.509 certificate from the identity provider metadata.\"\n      }\n    ],\n    \"registrationFamily\": \"crypto-formats-signed-envelopes\",\n    \"inputMaxLength\": 1000000,\n    \"inputErrorCode\": \"CRYPTO_FORMATS_SIGNED_ENVELOPES_TOO_LONG_SAML\",\n    \"note\": \"Verified in your browser against the certificate you paste. Up to 1000000 characters.\",\n    \"experience\": {\n      \"automatic\": false,\n      \"single\": false,\n      \"inputMaxLength\": 1000000,\n      \"inputMode\": \"text\",\n      \"label\": \"SAML response\",\n      \"placeholder\": \"PHNhbWxwOlJlc3BvbnNlIC4uLg==\",\n      \"help\": \"Paste the SAMLResponse value or the XML. Up to 1,000,000 characters. Review the settings before running.\",\n      \"action\": null\n    },\n    \"mode\": \"explicit\",\n    \"interactive\": false\n  },\n  \"execution\": \"Browser interface\",\n  \"api\": null,\n  \"browser_agent\": {\n    \"supported\": true,\n    \"name\": \"run_current_tool\",\n    \"discovery\": \"WebMCP on the human page in a supporting browser\",\n    \"verification\": \"See audit/API-AUDIT.md; availability is not verification\"\n  }\n}\n```\n\n## Page guide\n\nCheck the XML signatures in a SAML response in your browser against your identity provider certificate. See exactly which element each signature covers and whether the response shows signs of a signature wrapping attack.\n\nHow can we improve this tool?\n\nReport a problem or share an idea.\n\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\n\n### How to use SAML signature verifier\n\n1. Paste the SAMLResponse value or the XML.\n2. Paste the signing certificate from your identity provider metadata.\n3. Run the tool and read the verdict, the covered elements and the wrapping checks.\n\n## Useful next steps\n\n- [SSL checker](https://happytails.ai/en/web-tools/ssl-checker/) ([Markdown](https://happytails.ai/en/web-tools/ssl-checker.md))\n\n- [Base64 encoder decoder](https://happytails.ai/en/developer-tools/base64-encoder-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/base64-encoder-decoder.md))\n\n- [JWT decoder](https://happytails.ai/en/developer-tools/jwt-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/jwt-decoder.md))\n\n## Method\n\nEach ds:Signature is checked under W3C XML Signature 1.1: one reference to the ID of the element that contains the signature, exactly two transforms (the enveloped signature transform, then Exclusive XML Canonicalization 1.0), the digest, and the RSA or ECDSA signature over the canonical SignedInfo with SHA-256, SHA-384 or SHA-512. SHA-1, inclusive canonicalization and other transforms are refused. A reference with only the enveloped signature transform is refused too, because XML Signature then canonicalizes it inclusively.\n\n### Wrapping defences\n\nIDs must be unique, every signature must sit inside the element it signs, signed elements must be the Response or an Assertion directly inside it, there must be exactly one assertion, and every assertion must be covered by a valid signature. The report names the exact covered element so you can compare it with what your service provider reads.\n\n### What it does not check\n\nAudience, recipient, time conditions and replay are the service provider's job, and the certificate's own validity dates are only reported. Nothing is fetched; only the certificate you paste is trusted.\n"
}