Does this tool verify the SAML signature?

No. It reports whether the Response and each assertion are signed, the declared algorithms, embedded certificates and whether each reference points to its own element, and it always states that cryptographic verification is not performed. Verify signatures with your SAML library and the trusted identity provider certificate.

Why is my assertion expired when the clocks look right?

NotOnOrAfter is exclusive and the default clock skew is 0 seconds. The check shows the exact number of seconds since expiry; if the gap is small, synchronize the server clocks or choose an explicit clock skew to see whether a tolerance would accept it.

SAML Response Validator

Check SAML timestamps, audience, destination and recipient

SAML input

SAML response

Paste a SAMLResponse value (base64), the form body, or the Response XML.

Expected values

Optional. Empty fields are not compared; the received value is shown instead.

Issuer

Identity provider entity ID

Audience

Your service provider entity ID

Destination

ACS URL on the Response

Recipient

ACS URL in SubjectConfirmationData

InResponseTo

ID of your AuthnRequest

Validation time

Empty uses the current time when you validate. Enter a fixed time to reproduce a result.

Clock skew

Tolerance for timestamps. 0 s is strict; nothing is assumed.

Validation

No SAML response yet

Paste a SAML response, upload a file, or load an example. Expected values are optional.

Check details

Select a check to see its details.

SAML DecoderDecode SAMLRequest and SAMLResponse from POST, Redirect or raw XML SAML Metadata ParserInspect IdP, SP and federation metadata: endpoints, certificates and issues X.509 Certificate InspectorDecode PEM and DER certificates and check expiry, SANs and chain order OAuth 2.0 & OIDC DebuggerBuild, inspect and fix OAuth and OIDC flows

What the validator checks

SAML Response Validator decodes a SAML 2.0 Response and runs protocol, time and configuration checks that explain why a sign-in fails. Each check is PASS, WARNING, FAIL or INFO, grouped by Response, each assertion, and signature. It covers Version, ID, IssueInstant, Issuer, Destination, InResponseTo, the status code with nested codes and message, the bearer subject confirmation with Recipient and its own time window, Conditions NotBefore and NotOnOrAfter, AudienceRestriction, the AuthnStatement session expiry, and duplicate IDs or misplaced assertions that point to signature wrapping.

Expected values, time and clock skew

Enter the values your service provider expects: issuer, audience, destination, recipient and the InResponseTo ID of your request. Comparisons are exact; when a value differs, the detail panel explains the likely cause, such as a trailing slash, http instead of https, letter case, a different host or extra whitespace. Destination and Recipient are separate checks. Every timestamp is checked on its own against the validation time, which is the current time or a fixed time you enter. The clock skew is 0 seconds unless you choose 60, 120, 300 seconds or a custom value; a timestamp that only passes because of the skew is a WARNING, and messages state the exact number of seconds.

Limits

Cryptographic signature verification is not performed: the tool reports whether the Response and each assertion are signed, the declared algorithms, embedded certificates and whether each reference points to its own element, but it never states that a signature is valid. Encrypted assertions cannot be decrypted, so their contents are not checked. DOCTYPE and ENTITY declarations are rejected. Inputs up to 1 MB are accepted. To read attributes and the full XML, use SAML Decoder.

Privacy

Validation runs entirely in your browser. The SAML response and the expected values are not uploaded, stored, logged or added to the URL, and links to related tools never carry the message.