SAML Assertion Size Calculator

assertion = fixed XML skeleton + attributes × bytes each + group values × bytes each + signature + embedded certificate, then base64-encoded at 4/3. A signed assertion carrying an embedded certificate is around 2.8 KB before a single attribute, which is why real assertions land in the 4–8 KB range the specification's implementers expect. Base64 then adds a third on top, and the Redirect binding compresses first but pays it back in URL encoding.

Assertion size is the usual root cause of SAML logins that work for most staff and fail for anyone in many groups, because the response outgrows a URL, a cookie or the default 8 KB header buffer.

This calculator takes 8 inputs: Attributes in the assertion, Average bytes per attribute, Group or role values, Average bytes per group value, Assertion is XML-signed, Signing certificate embedded in KeyInfo, Binding, Size remaining after DEFLATE. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because a response carries the signed assertion and rarely survives a URL. Even after DEFLATE and base64 it typically exceeds the 2 KB that old proxies and browsers reliably accept, so the specification expects responses over POST and reserves Redirect for the much smaller authentication request.

Release only the attributes the service provider consumes, filter group values to those relevant to that application, reference the signing certificate by thumbprint instead of embedding it in KeyInfo, and sign the assertion rather than both the assertion and the response so you pay for one signature block instead of two.