SAML Metadata Analyzer

Inspect SAML metadata for entity IDs, endpoints, bindings and signing certificates, and catch expired certificates and binding mismatches before a federation breaks.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

SAML metadata An EntityDescriptor or an EntitiesDescriptor containing several. Parsed in your browser.

Federations break on certificate expiry

If you take one thing from this page, take that. The overwhelmingly most common SAML incident is a signing certificate that quietly expired, and it is painful for a specific reason: rollover is not automatic. Every partner has to load your new metadata, and when partners are other organisations that takes days or weeks rather than minutes.

Worse, implementations disagree about what to do with an expired certificate. Some reject it and single sign-on stops dead, which at least announces itself. Others ignore expiry entirely - which is the dangerous case, because the trust anchor has silently stopped meaning anything and nobody notices.

So certificate dates are checked and reported in bands: expired, under 30 days, under 90 days. The fix is always the same and always worth starting early - publish the replacement certificate alongside the current one, so partners can accept either during the changeover.

What else it checks

Plain HTTP endpoints. Assertions travel through the browser to these URLs, and an assertion is enough to sign in as the person it names. Graded critical.
WantAssertionsSigned="false" on a service provider - it is telling identity providers it will take unsigned assertions, and if it means it, anyone who can post to its endpoint can assert any identity. Not stating the attribute at all defaults to false, which is the same thing said more quietly.
Weak keys and SHA-1 certificate signatures, which usually date the whole setup.
Binding mismatches - an assertion consumer endpoint on HTTP-Redirect, for instance. Responses are too large for a URL, so this appears to work until an assertion grows past the browser's URL limit, at which point it looks like an intermittent bug rather than a misconfiguration.
Internal hostnames and localhost, which usually mean a development configuration was published by mistake.
Expired or missing validUntil. Strict consumers reject expired metadata outright; metadata with no expiry gets cached indefinitely, so a key rotation may never reach some partners.

Self-signed certificates are normal here

Worth saying because tools that check certificates elsewhere flag it. In SAML, trust comes from the metadata exchange itself rather than from a certificate authority - the two parties swap metadata over a channel they already trust, and the certificate inside is the anchor from then on. A self-signed certificate in SAML metadata is reported as information, not a problem.

It reads the metadata, not the deployment

Metadata states intent. Whether the identity provider actually signs what it claims to sign, and whether the service provider actually verifies, cannot be seen in this document - so that gap is reported as its own finding rather than left implied. The SAML Response Decoder is where you check the live flow.

Frequently asked questions

Where do I get my metadata?

Identity providers usually publish it at a well-known URL; service providers often expose theirs at /saml/metadata or similar. Both are public documents by design.

Can I paste an aggregate with many entities?

Yes. An EntitiesDescriptor is read and every entity inside is analysed separately.

My certificate has months left. Why is it flagged?

Under 90 days it is reported as medium severity, because SAML rollover involves other people's schedules. That is a nudge to start the conversation, not an emergency.

How do I roll a certificate without downtime?

Publish both in the metadata - two KeyDescriptor elements with use="signing" - and give partners time to reload before you switch which one you sign with. Remove the old one afterwards.

Is my metadata uploaded?

No. Parsing and certificate decoding both happen in your browser.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.