SAML inspector
Paste a SAML message in any form: a redirect URL, a POST body, a raw HTTP request, base64 (deflated or not), or XML. It is decoded in your browser with WebAssembly; nothing you paste is sent to the server.
Check signatures against a certificate
Every XML signature is checked with the certificate in its own KeyInfo anyway, which shows whether the message was changed. Only a certificate you trust, such as the one in the issuer's metadata, shows who signed it.
To see what an IdP sends, set an SP's ACS URL to https://gosaml.dev/inspect: the Response it posts is shown here. That request does reach the server, which puts it in the page and keeps nothing.