Login Tracer: SAML & OIDC Auth Debugger by Phase Two

Debug SAML, OIDC and OAuth logins in DevTools, with Keycloak-aware hints. Decodes and verifies locally, with no permissions.

Login Tracer is a Chrome DevTools panel for anyone who builds, configures, or supports single sign-on. Open DevTools, switch to the Login Tracer tab, and log in: every SAML and OpenID Connect / OAuth 2.0 request in the login is decoded, grouped into a flow, and checked for common mistakes. What it shows - A timeline of each login flow, grouped by state, nonce, authorization code, SAML request ID / InResponseTo, and RelayState, including brokered logins that hop from an app to Keycloak to an external identity provider and back. - SAML: decoded and pretty-printed XML for AuthnRequest, Response, LogoutRequest and LogoutResponse (HTTP-Redirect and HTTP-POST bindings), with a summary of issuer, destination, ACS URL, audience, NameID, conditions, attributes, signatures, encryption, and status codes in plain English. - OIDC and OAuth: authorization requests, callbacks (query, form_post, and fragment responses visible in redirects), token requests and responses, discovery, JWKS, UserInfo, and logout. - JWTs: header and payload with claim explanations, issued/expiry times relative to the capture and to now, and Keycloak realm and client roles. - Findings: missing PKCE, state, or nonce; implicit flow; redirect_uri mismatches between the authorize, callback, and token requests; state and nonce mismatches; SAML Destination, ACS, Recipient, and Audience mismatches; expired or not-yet-valid assertions (clock skew); unsigned assertions; SHA-1 signatures; and OAuth and SAML error codes explained. - Signature verification without network access: SAML XML and redirect signatures against a certificate or metadata you paste (or metadata captured in the trace, after you confirm it), and JWTs against the JWKS captured in the same login flow. - Keycloak awareness: recognizes realm endpoints, identity-brokering callbacks, and login steps, and explains the most likely Keycloak setting behind an error (Valid Redirect URIs, Name ID format, client signature required, PKCE enforcement, and more). Share safely Export a redacted trace for a support ticket. Cookies, Authorization headers, passwords, client secrets, PKCE verifiers, refresh tokens, and token and SAML signatures are always removed, and you can optionally mask user identifiers. You see a full preview of the file before saving it. Private by design - Runs entirely inside DevTools. It reads only the network log of the tab you are inspecting, and only while DevTools is open. - Requests no permissions and no host access. No content scripts, no background page. - Makes no network requests of its own: no analytics, no telemetry, no accounts. A Content Security Policy blocks outgoing connections from the extension. - Nothing is stored after you close DevTools. Built by Phase Two, the team behind managed Keycloak hosting and enterprise Keycloak support: https://phasetwo.io More about Login Tracer: https://phasetwo.io/tools/login-tracer