AuthTrace: SAML, OIDC & OAuth sign-in tracer

Capture and decode SAML, OpenID Connect, OAuth 2.0 and WS-Federation sign-ins in DevTools. Explains SSO errors. Local only.

AuthTrace adds a panel to Chrome DevTools that shows every step of a sign-in - SAML, OpenID Connect, OAuth 2.0 and WS-Federation - decodes it, and tells you in plain words what is wrong. Built for IT and identity admins, SSO engineers and support teams who are tired of copying SAMLResponse values into websites. WHAT IT DOES • One timeline for the whole sign-in. Every hop between your app, the identity provider and back, drawn as a sequence with the right roles (SP, IdP, RP, OP, API). Unrelated requests are hidden unless you want them. • SAML, fully decoded. Redirect and POST bindings, SAMLRequest and SAMLResponse, RelayState and logout messages. Pretty XML with Issuer, NameID, Audience, Destination, Recipient, InResponseTo, NotBefore / NotOnOrAfter, AuthnContext and attributes highlighted. • Signatures and certificates. See which element is signed, check the signature locally against the certificate in the message, and read the certificate's subject, issuer, expiry and fingerprints. SHA-1, unsigned responses and signature-wrapping patterns are flagged. Encrypted assertions are detected (they can't be read without the SP's key). • OpenID Connect and OAuth 2.0. authorize, callback, token, userinfo, end_session, discovery and JWKS. id_token and access_token claims decoded with human-readable times. PKCE checked: S256 vs plain, and whether the code_verifier really matches the code_challenge. state and nonce matched across the flow. • JWT checks. Expiry and clock skew, alg "none", HMAC tokens, audience and issuer mismatches, at_hash. Verify a token's signature with the issuer's published keys - only when you click. • WS-Federation. wsignin1.0 requests and RSTR responses, including SAML 1.1 assertions, AppliesTo and token lifetime. • Plain-words diagnosis. Audience mismatch, expired assertion, clock skew, wrong ACS URL, missing InResponseTo, redirect_uri mismatch, invalid_grant and dozens more - each with what it means and how to fix it. Error codes returned by common identity providers are explained too. • Decode anything. Paste a SAMLResponse, a JWT or a whole URL someone sent you. Import HAR files from users, or SAML-tracer exports. • Export a single trace as JSON or HAR. AUTHTRACE PRO (one-off £19, no subscription) • Redacted sharing: an HTML report or HAR with passwords and secrets removed, tokens cut or reduced to their claims, emails and NameIDs masked or hashed, cookies stripped. Safe to attach to a ticket or send to a vendor. • Trace diff: put a working and a failing sign-in side by side and see exactly which field changed. • Certificate watchlist: keep an eye on IdP signing certificates and see rollovers coming. • Saved sessions: keep traces between DevTools sessions. Pro is unlocked with a licence key you paste into the panel. The key is checked offline. There are no pop-ups, overlays or embedded payment pages - the Buy button simply opens Stripe in a new tab. PRIVACY Everything happens on your computer. AuthTrace has no servers that receive your data, no analytics and no telemetry. It requests no special permissions and no access to websites: it only sees traffic while DevTools is open on a tab. Captured data is never transmitted. The only network request AuthTrace can make is the optional "Verify with issuer keys" button, which downloads an identity provider's public signing keys. HOW TO USE 1. Open DevTools (F12) on the tab where you sign in, and pick the AuthTrace tab. 2. Sign in as usual. 3. Read the diagnosis, click any step for details. Works with any identity provider that follows the SAML 2.0, OpenID Connect, OAuth 2.0 or WS-Federation standards.