lc. Identity Tools
Tools

SAML metadata inspector

Paste the metadata of an IdP or an SP and review its entityID, endpoints by binding, NameID formats, attributes and certificates, with their thumbprints and expiry.

Processed locally, in your browser
Input

EntityDescriptor or EntitiesDescriptor (federations), as XML or base64. This page cannot download metadata from a URL: open it in another tab and paste the XML.

Result

Paste SAML metadata to inspect it.

Notes

  • The SHA-1 and SHA-256 thumbprints are what most consoles (ADFS, Entra ID, One Identity, Okta) ask for when you set up a trust, and what you compare over another channel to confirm the certificate is the right one.
  • In SAML the metadata certificate is only a container for the public key: its issuer and signature algorithm do not matter, but its expiry does, because many SPs stop accepting signatures from an expired certificate.
  • For a certificate rollover without downtime, the IdP publishes the new certificate next to the current one (two KeyDescriptor use="signing"), the SPs refresh the metadata, and only then does the IdP start signing with the new one.
  • The metadata signature is reported, not validated. For a specific SAML message use the SAML decoder.