XML Formatter & Converter
Format, minify and validate XML, or convert it to JSON.
Runs entirely in your browser — nothing you paste is uploaded.
About XML Formatter & Converter
XML is still what you get from SOAP endpoints, RSS and Atom feeds, sitemaps, Android layouts, Maven builds and half the enterprise integrations in existence. This formats it readably, minifies it back down, tells you where it's broken, and converts it to JSON when you'd rather work with objects.
Validation reports the line of the first parse error — an unclosed tag, a mismatched closing tag, an unescaped `&` in text content. XML is strict in ways HTML is not: every tag closes, attribute values are always quoted, and the five predefined entities are the only ones you get for free.
The XML-to-JSON conversion has to make choices, because the two formats don't map cleanly. Attributes are preserved with a prefix so they don't collide with child elements; repeated sibling elements become arrays; text content in a mixed node gets its own key. These conventions are stated in the output so nothing about the result is a surprise.
External entity declarations are refused rather than resolved. An XML parser that expands external entities can be made to read local files or make network requests on the parser's behalf — the XXE class of vulnerability — and while a browser-side parser is a much smaller target than a server one, there is no reason to expand them at all here.
Frequently asked
›Why does my XML fail on an ampersand?
A bare `&` is illegal in XML text and attribute values — it starts an entity reference. Write `&`. The same applies to `<` in text content, which must be `<`. Only five entities are predefined: `&`, `<`, `>`, `"` and `'`.
›What is XXE and does it affect this tool?
XML External Entity injection: a document declares an entity pointing at a file path or URL, and a parser that resolves it leaks the contents. This parser refuses external entity declarations outright, so there's nothing to exploit — but the same document handed to a default-configured server-side parser often is exploitable.
›How are attributes represented in the JSON output?
With a distinguishing prefix on the key, so an element with both an `id` attribute and an `id` child element doesn't collide. Repeated sibling elements collapse into an array, which means a document with one `<item>` and a document with three produce different shapes — the usual gotcha when converting feeds.
›Does formatting change the document's meaning?
It can. Whitespace between elements is significant in XML unless a schema says otherwise, so re-indenting a document with mixed content — text and elements as siblings — can alter it. Formatting a data-only document is safe; formatting XHTML or a document with `xml:space="preserve"` needs care.
›Can it validate against a schema?
No. This checks well-formedness — that the document parses — not validity against a DTD, XSD or RELAX NG schema. Those need the schema itself and a validating parser.