How do I format and validate XML online?
Paste your XML and click Format to instantly pretty-print it with proper indentation, or click Minify to compress it. The tool validates your XML structure in real time, highlighting syntax errors like unclosed tags or mismatched elements. Everything runs in your browser — your data never leaves your device.
<root><user id="1"><name>Alice</name><email>a@b.com</email></user></root>
<root>
<user id="1">
<name>Alice</name>
<email>a@b.com</email>
</user>
</root>XML Formatter & Validator
Format, beautify, validate, and minify XML documents instantly. Supports comments, CDATA, processing instructions, and namespaces.
About XML Formatting
This tool formats XML documents for readability by adding proper indentation and placing each element on its own line. It validates your XML using the browser's built-in DOMParser before formatting.
Validation: Checks for well-formedness — properly nested tags, matching open/close tags, valid attribute syntax, and correct use of special characters. Reports the first error found.
Minify: Removes all unnecessary whitespace between tags and strips comments, producing compact single-line XML. Useful for reducing payload size in APIs and configuration files.
Supported features: XML declarations (<?xml?>), processing instructions, comments (<!-- -->), CDATA sections (<![CDATA[]]>), DOCTYPE declarations, namespaced elements, and self-closing tags.
Tips & Best Practices
Use XML namespaces correctly to avoid element conflicts
When combining XML from different sources (SOAP envelopes, SVG in HTML, RSS feeds), namespaces prevent element name collisions. Always declare namespaces on the root element with xmlns:prefix and reference elements as prefix:elementName. Default namespace (xmlns without prefix) applies to the element and all descendants.
Self-closing tags behave differently in XML vs HTML
In XML, <br/> is valid and means an empty br element. In HTML, <br/> is treated as <br> — the slash is ignored. But <script/> in HTML does NOT self-close — the browser waits for </script>. When generating XHTML or mixing XML/HTML, always use explicit closing tags for non-void elements.
XML External Entity (XXE) attacks can read server files
An XML document with <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]> can exfiltrate server files when parsed by a vulnerable XML processor. Disable external entity processing in every XML parser: set disallow-doctype-decl or disable external-general-entities. This is OWASP Top 10 #5.
CDATA sections let you embed raw text without escaping
Instead of escaping every < and & in embedded code snippets, wrap them in <![CDATA[...]]>. Everything inside CDATA is treated as raw text. This is essential for RSS feed descriptions containing HTML and SOAP messages containing XML fragments. Note: CDATA cannot be nested.