FREE TOOLS
SAML Assertion Structure Inspector
Inspect the declared subject, conditions, audiences and attributes of supplied SAML assertion XML.
SAML2 Assertion XML
saml-assertion-inspector.json (complete report)
Browser only
Runs locally in your browser. Your files, pasted content and generated output are not uploaded. Reset clears this tool’s working data.
This tool needs JavaScript. If it does not load, refresh the page and try again.
How to use this tool
- Enter values using the examples, or choose a local file where requested. Follow the displayed supported input shapes and limits.
- Choose Calculate result and inspect the complete result.
- Download result to save the primary file. Where supplied, additional links save source files and the full JSON report. Reset restores examples and clears output.
Examples
SAML2 Assertion XML: <saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="a1" Version="2.0" IssueInstant="2026-10-23T00:00:00Z"><saml:Issuer>https://idp.example.com</saml:Issuer><saml:Subject><saml:NameID>ada</saml:NameID></saml:Subject><saml:Conditions NotBefore="2026-10-23T00:00:00Z" NotOnOrAfter="2026-10-23T01:00:00Z"><saml:AudienceRestriction><saml:Audience>urn:demo</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AttributeStatement><saml:Attribute Name="email"><saml:AttributeValue>ada@example.com</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>
Limitations
- One namespace-correct SAML2 Assertion with Version2.0;20000 XML elements/40 levels/100000 input UTF16 units. Extract direct declared issuer,NameID,conditions,audiences and ordered attributes. Missing optional declarations report null; text,empty,absent and namespace-correct xsi:nil values remain distinct. Reject ambiguous repeated singleton fields,complex AttributeValue XML and encrypted content. XML1.0/UTF8 declaration only;no DTD/entities/processing instructions. No signature,authentication,audience/time trust,datatype interpretation or full schema validation.
- Text fields are limited to100,000 UTF16 units each and400,000 combined UTF8 bytes; file fields have their own displayed limits. Combined output is at most4MiB. Processing stops after30 seconds; tool-specific bounds may be tighter.
- Generated source is a downloadable result and is not executed here. Inspection does not establish remote behavior, trust or standards certification.