AuthLens — SSO Troubleshooter

Capture, decode, and diagnose SAML & OIDC sign-in flows. Root-cause findings in plain English. 100% local, zero data collection.

AuthLens helps IT and identity teams understand why a Single Sign-On login or signup failed. It works with the two standards behind most enterprise sign-ins: SAML and OpenID Connect (OIDC / OAuth 2.0). Many tools stop at decoding a SAML assertion or a token and leave you to interpret the result yourself. AuthLens goes a step further: it explains the likely root cause in plain language, and points to who can fix it — the identity provider's administrator, the application's configuration, the browser's cookie settings, or the network. It does this by observing the sign-in redirect chain in your browser, decoding each step, and checking it against a set of built-in diagnostic rules. What it helps with: - Reads SAML responses and flags common problems such as expired certificates, clock-skew and timing issues, audience or destination mismatches, and missing user attributes. - Reviews OIDC and OAuth 2.0 sign-ins for issues like redirect mismatches, authorization-code errors, PKCE failures, and token-validation problems. - Highlights session and correlation cookies that the browser quietly dropped on the callback — a frequent and easily missed cause of failed logins. - Recognizes error messages shown on your identity provider's own pages and explains what they mean and where to correct them. Also included: - A short summary that shows, at a glance, what failed and who owns the fix. - A step-by-step timeline of the whole sign-in, including flows that span multiple tabs and private windows. - Decoded and raw views of the underlying messages, headers, and cookies. - Share-ready exports for support tickets, with secrets and tokens automatically redacted. - An optional export for AI assistants, turned off by default behind an explicit toggle. Privacy: AuthLens runs entirely on your own machine. It makes no network requests of its own and contains no analytics, tracking, or remote code. Captured data is held only in memory for the current browser session and is cleared when you close the browser. Passwords are masked before anything is stored. The project is open source. AuthLens is a diagnostic aid, not a replacement for your identity provider's server-side logs.