---
id: signxml
version: "5.1.0"
license: Apache Software License
license_treatment: permissive
maintenance: active
---

# signxml — Python XML Signature and XAdES library

License: permissive · Maintenance: active · Downloads: 3.2M/mo

## What it is and what it does

SignXML is a Python implementation of the W3C XML Signature standard, used to cryptographically sign and verify XML documents in enterprise protocols like SAML 2.0, XAdES, EBICS, and WS-Security. It wraps lxml and cryptography to provide both standard XMLDSig operations and extensions for X.509 certificate chain validation, hostname/CN verification, and XAdES support.

The library is designed with security-first defaults: it uses a libxml2-based parser hardened against common XML attacks, disables network calls and unsafe transforms by default, and emphasizes the "see what is signed" principle to prevent signature-wrapping attacks. It supports exclusive XML canonicalization with inclusive prefixes, certificate validity checks at a specific point in time, and flexible trust establishment via pre-shared certificates, CA files, or subject name matching.

Use it for:

- Verify SAML 2.0 assertions from identity providers by extracting and validating X.509 certificates from SAML metadata.
- Sign and verify XAdES digital signatures for long-term archival and legal compliance in document workflows.
- Validate XML signatures in EBICS banking protocols to ensure message authenticity and non-repudiation.
- Establish trust in XML-based web services by verifying WS-Security signatures with certificate chain validation.
- Prevent SAML signature-wrapping attacks by configuring expected signature location and verifying only the returned signed_xml data.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

SignXML implements W3C XML Signature (XMLDSig) standard for signing and verifying XML documents, with support for SAML 2.0, XAdES, EBICS, and WS-Security protocols.

Yes. SignXML is actively maintained, has no known vulnerabilities, low install friction, and implements a critical security standard for enterprise XML protocols. It is appropriate for production use in SAML, XAdES, EBICS, and WS-Security integrations where XML signature verification is required.

## Install

pip install signxml
uv add signxml
poetry add signxml

## Installing signxml

Before you install: Low friction: pure Python wheel with three stable, widely-used dependencies (lxml, cryptography, certifi). Active maintenance with a release 40 days ago and continuous integration.

License in practice: Apache Software License (permissive): you can use, modify, and distribute signxml freely in commercial and private projects, with minimal restrictions beyond attribution.

Quickstart:

from lxml import etree
from signxml import XMLSigner, XMLVerifier

root = etree.fromstring(data_to_sign)
signed_root = XMLSigner().sign(root, key=key, cert=cert)
verified_data = XMLVerifier().verify(signed_root).signed_xml

Requires lxml (libxml2-based XML parser) and valid X.509 certificate/key pair in PEM format; openssl needed to generate test certificates.

Verify before relying:

- Whether XPath and XSLT transform support is available or intentionally excluded for security
- Specific XAdES profile coverage beyond the excerpt's mention of XAdES support

## Package facts

- License: Apache Software License (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 3.2M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

xml signature verification, xmldsig implementation, saml assertion signing, xades digital signatures, xml payload security, certificate chain validation xml, xml canonicalization, xml-security, saml, digital-signatures

[View on SkillFed](https://skillfed.io/packages/signxml) · [View on PyPI](https://pypi.org/project/signxml/)