XML Formatter & Validator
Format, minify, validate and convert XML in your browser: pretty-print with 2-space, 4-space or tab indent, exact line and column error reporting, XML to JSON conversion, syntax-highlighted output, copy and download, with DOCTYPE refused for XXE safety.
Your result will appear here.
🛡️ XXE safety: DOCTYPE declarations are refused. They are the only place external entities can be defined, so a file that tries to load local files or remote URLs through entities is rejected before parsing.
🔒 Privacy: formatting, validation and conversion run locally in your browser. Your XML is never uploaded, stored or seen by anyone else.
More developer tools
How this calculator works
XML is still the exchange format for sitemaps, RSS feeds, SVG files, Office documents and countless APIs, and a single misplaced closing tag is enough to make a whole file unreadable. This formatter takes raw, single-line or messy XML and re-indents it into clean, readable lines, so the structure is obvious at a glance. Everything runs in your browser: paste XML or upload a .xml file, pick 2-space, 4-space or tab indent, and copy the result or download it as a .xml file.
Formatting is only half the job. The built-in validator checks well-formedness and, when something is wrong, tells you the exact line and column plus what went wrong: a closing tag that does not match its opening tag, an unclosed element, a bare & that should be written as &, a duplicate attribute, or an attribute value missing its quotes. Fixing XML by guessing is slow; an exact position turns it into a one-minute job. The minify mode does the opposite of formatting, stripping insignificant whitespace so the file is as small as possible for transfer, and the XML to JSON mode converts the document into a JSON object, with attributes as @name keys, text as #text, and repeated elements as arrays, which is handy when an API speaks JSON but your data arrives as XML.
One safety rule is built in and worth knowing about. DOCTYPE declarations are refused outright, because they are the only place external entities can be defined, and a crafted file can use them to make a parser read local files or fetch remote URLs, a class of attack called XXE. Some formatters silently process such files, which is fine for a trusted file but risky for one from an unknown source. This tool rejects the DOCTYPE before parsing starts, so a malicious file never gets processed. For everyday work, that means sitemaps, RSS feeds, SVG, config files and API responses all format and validate here, while anything that needs a DOCTYPE belongs in a dedicated XML editor.