AuthTrace › AuthTrace vs SAML-tracer
A SAML-tracer alternative that also reads OIDC and tells you what broke
SAML-tracer is the tool most identity providers' setup guides point to, and it does its job well: a free, open-source window that logs requests and decodes the SAML and WS-Federation messages in them. AuthTrace does that job inside Chrome DevTools, then keeps going. It reads OpenID Connect and OAuth sign-ins too, checks the signatures and tokens, and tells you in plain words which value is wrong.
Side by side
SAML-tracer column checked against SAML-tracer 1.9.5, its current source on GitHub, in November 2026.
| SAML-tracer | AuthTrace | |
|---|---|---|
| Where it runs | Its own window, opened from the toolbar | A panel inside Chrome DevTools, next to Network |
| Browsers | Firefox, Chrome and Edge | Chrome |
| Permissions at install | Read and change all your data on all websites (webRequest, <all_urls>) | None |
| SAML 2.0 | Decoded XML | Decoded XML, with Issuer, Audience, Destination, InResponseTo and the validity window picked out |
| WS-Federation | Yes | Yes, including SAML 1.1 assertions, AppliesTo and token lifetime checks |
| OpenID Connect and OAuth 2.0 | No | authorize, callback, token, userinfo, logout, discovery and JWKS |
| JWTs | No | Claims decoded with readable times; signature verified against the issuer's published keys on request |
| XML signatures | Embedded certificates offered as downloads | Signature verified against the certificate in the message; SHA-1 and signature-wrapping red flags |
| Certificates | Download and open them yourself | Subject, issuer, expiry and fingerprints shown in place |
| PKCE, state and nonce | No | Verifier checked against the challenge; state and nonce matched across the flow |
| Diagnosis | No, you read the XML | Each problem named, with the setting to change |
| Import | Its own JSON exports | SAML-tracer JSON exports, HAR files, and pasted SAMLResponse, JWT or URL |
| Export | JSON, with optional hashing or blanking of cookies and POST values | JSON or HAR (free); redacted HTML report and HAR that mask tokens and personal data (Pro) |
| Compare two sign-ins | No | Working vs failing trace diff (Pro) |
| Price and licence | Free, open source (BSD) | Free; Pro is £19 once |
What AuthTrace adds
Half your sign-ins aren't SAML any more
Newer apps use OpenID Connect, and a SAML-only tool shows them as a list of redirects. AuthTrace lays the same sign-in out as one timeline across browser, app and identity provider, decodes the id_token and access_token, and checks the parts that usually break: the redirect_uri, the PKCE verifier, the state and the nonce. See invalid_grant and redirect URI mismatch for the kind of thing it catches.
It reads the XML so you don't have to
With SAML-tracer you find the Audience, compare it with the app's entity ID by eye, and work out the clock difference from NotBefore yourself. AuthTrace does those comparisons and reports Audience mismatch or Assertion not valid yet (clock skew), with both values and the setting that fixes it. The audience, clock skew and signature guides walk through each check.
It checks the signature, not just shows it
A response that decodes fine can still be refused because it was signed with last year's certificate. AuthTrace verifies the XML signature in your browser, shows which element was signed and when the certificate expires, and flags SHA-1 and wrapping tricks.
Keep SAML-tracer if
- You work in Firefox. AuthTrace is Chrome-only.
- Your organisation only allows open-source extensions it can audit. SAML-tracer is open source; AuthTrace is not.
- You only ever need to read raw SAML XML and are happy doing the comparisons yourself.
Plenty of admins keep both: SAML-tracer exports still open in AuthTrace, so a trace a colleague captured in SAML-tracer isn't wasted.
Moving over takes a minute
- Add AuthTrace to Chrome. It asks for no permissions, so there is no warning to click through.
- Open DevTools on the app's tab before you start the sign-in, and choose the AuthTrace panel. Like the Network panel, it only sees traffic while DevTools is open.
- Sign in. Each hop appears on the timeline as it happens, and the diagnosis pane lists what is wrong.
- Got an old SAML-tracer export? Click Import in the panel and pick the JSON file.