XMLDSig debugging utility
Validate supported Reference digests and SignatureValue, inspect canonicalized SignedInfo and digest bytes, review KeyInfo, and see exactly which XML content a signature covers.
XML Signature debugger
The tool validates supported same-document Reference digests, canonicalizes SignedInfo, and verifies supported RSA SignatureValue algorithms using public key material resolved from KeyInfo. It is a practical debugging aid, not a certified XML Signature or certificate-trust validator.
The XML stays in your browser and is not saved by this tool.
Canonicalized SignedInfo will appear here.
SignedInfo UTF-8 bytes will appear here.
Signed content coverage will appear here.
KeyInfo inspection will appear here.
Signature diagnostics will appear here.
Reference digests
Canonicalized XML will appear here.
Canonical UTF-8 bytes will appear here.
Namespace details will appear here.
Reference diagnostics will appear here.
Supported in this version
Empty-document URIs and short same-document #ID references resolved from common ID-style attributes, including namespaced Id attributes such as wsu:Id.
Canonical XML 1.0, Canonical XML 1.1, and Exclusive XML Canonicalization 1.0, including comments variants and Exclusive C14N InclusiveNamespaces PrefixList.
SHA-1, SHA-256, SHA-384, and SHA-512 through the browser Web Crypto API.
RSA-SHA1, RSA-SHA256, RSA-SHA384, and RSA-SHA512 using PKCS#1 v1.5 verification.
ds:X509Certificate, ds:RSAKeyValue, and WS-Security SecurityTokenReference values that resolve to an X.509 BinarySecurityToken.
No private keys, certificate trust validation, revocation checks, external URI fetching, XPointer, XPath, XSLT, DSA, ECDSA, HMAC, or unsupported transforms. Unsupported processing is reported instead of guessed.
FAQ
The tool separates Reference digest validation from cryptographic SignatureValue verification. A supported signature is marked valid only when all supported References match and SignatureValue verifies with supported public key material resolved from KeyInfo.
SignatureValue is calculated over the canonical form of SignedInfo. The SignedInfo view and byte preview expose the exact supported UTF-8 input passed to RSA verification.
The tool lists the resolved Reference targets and their exact document paths. It also checks whether common SOAP Body, WS-Security Timestamp, and WS-Addressing Action, To, or MessageID elements are inside a resolved referenced node. Coverage is an inspection aid, not an application-specific security-policy verdict.
Duplicate ID-style values make short same-document Reference resolution ambiguous and can be relevant to XML signature wrapping or substitution problems. The tool refuses to guess a target and shows every matching path.
No. It only means the cryptographic SignatureValue verifies with a supported public key found in KeyInfo. The tool does not validate certificate trust chains, revocation, or signer identity.
After XML parsing, O'BRIEN and a literal apostrophe represent the same text value. Literal ' represents different character data and remains visibly escaped in canonical XML. The diagnostics highlight suspicious double-escaped entity text in the raw XML.
No. Use synthetic or appropriately de-identified test data only.
Practical guide
XML Digital Signature verification has two related checks. Each Reference digest proves that selected XML content produced the expected hash after its declared transforms. The SignatureValue then proves that canonicalized SignedInfo was signed by the private key corresponding to the verification key.
URI and locate the target element by its ID.SignedInfo element using its CanonicalizationMethod.Worked example
<name>O'BRIEN</name>
<name>O'BRIEN</name>These strings do not necessarily represent the same parsed character data. In the first, &apos; can result in the literal text ' after one parsing layer; in the second, the character is an apostrophe. If the signed node is constructed, escaped, serialized, or parsed differently before hashing, the canonical bytes and digest will differ.
Similar failures arise from namespace context, omitted versus explicit attributes, whitespace in mixed content, line-ending normalization, inclusive namespace prefix lists, changed ID targets, or modifying a signed node after the digest was calculated.
Read the full XML Signature digest mismatch guide for a complete diagnostic sequence and worked canonicalization examples.
Troubleshooting
Authorship and review
Maintained and technically reviewed by Health Data Tools, drawing on more than 15 years of healthcare integration experience across HL7, FHIR, CDA, APIs, PKI, and clinical integration systems.
Technically reviewed:
Official references
These references support the technical context. Local implementation guides, vendor profiles, and receiving-system rules still take precedence for a specific interface.