XML Formatter and Validator
Pretty-print, minify, and well-formedness-check XML entirely in your browser. Parsing uses the native DOMParser, so tags, attributes, and text round-trip exactly — and no external entities or DTDs are ever fetched.
How to use this tool
What it does
Pretty-prints and validates XML, including the SAML and metadata documents common in identity systems.
When to use it
Use it to make dense signed XML or a metadata blob readable while checking it is well formed.
Worked example
Format a minified metadata document to inspect its element nesting.
Input
Result
What this XML formatter does
This tool takes raw XML and runs it through the browser's built-in DOMParser. If the document is well-formed, it walks the resulting DOM tree and re-serializes it. In pretty-print mode it inserts newlines and your chosen indentation (two spaces, four spaces, or a tab) so the structure is readable. In minify mode it strips the insignificant whitespace between tags to produce the most compact equivalent document. In check only mode it reports well-formedness without rewriting anything. Element names, attributes, attribute values, namespaces, and text content are preserved and re-escaped correctly on output.
Crucially, this is well-formedness checking, not validation. A well-formed document has balanced tags, quoted attribute values, a single root element, and properly escaped special characters. It says nothing about whether the document conforms to a DTD, an XSD schema, or a RELAX NG grammar. If you need schema conformance, reach for a dedicated validator — well-formedness is necessary but not sufficient.
When to use it
Reach for this tool when you receive minified or single-line XML — SOAP envelopes, RSS or Atom feeds, Android layout or manifest files, Maven pom.xml, SAML assertions, or signed XML payloads — and you want to read it. It is also handy when you are about to embed XML in a config file or a log and want the smallest well-formed representation, or when a downstream parser rejected your XML and you need to find the exact line and column of the syntax error.
Input and output
The input is any XML document or fragment with a single root element. Paste it into the box, pick a mode and an indent width, and the result updates as you type. The output is the reformatted (or minified, or merely validated) XML, with a badge summarizing the root element name and node count. Use Copy to put it on your clipboard or Download to save it as a .xml file with the application/xml media type. When the input is not well-formed, the output panel shows the parser's error message and, where the browser provides it, the line and column of the failure instead of guessing at a fix.
Security: no DTD or external-entity processing
The browser DOMParser deliberately does not resolve external entities, fetch external DTD subsets, or follow remote document references. That means this tool is not exposed to classic XXE attacks, billion-laughs-style entity expansion against network resources, or server-side request forgery through entity URLs. The flip side is that documents which genuinely depend on a DTD for entity definitions or default attribute values will not have those resolved here — unresolved entity references surface as a parse error rather than being expanded. Treat this tool as a syntax formatter, and do schema-aware processing in your application stack.
Common mistakes
- Expecting schema validation. Well-formed is not the same as valid. This tool never checks a DTD or XSD; a document can pass here and still be rejected by a schema validator.
- Pasting multiple root elements. XML requires exactly one root. A fragment with two sibling top-level elements is not well-formed — wrap it in a container element first.
- Reformatting whitespace-significant content. Pretty-printing normalizes inter-tag whitespace. If your XML stores meaningful spaces or newlines inside elements, use minify or check-only instead of pretty-print.
- Relying on entity expansion. Custom entities defined in an external or internal DTD are not resolved here and will trigger a parse error.
- Unescaped
&,<, or quotes. A bare ampersand or angle bracket in text or an attribute breaks well-formedness — escape them as&,<, and so on.
Related tools
Frequently asked questions
Does this tool validate XML against a DTD or XSD schema?
No. This tool performs well-formedness checking only: it confirms that tags are balanced, attributes are quoted, and the document parses as XML. It does not validate against a Document Type Definition (DTD), an XML Schema (XSD), or a RELAX NG grammar. A document can be perfectly well-formed yet still invalid against its schema, so use a dedicated validator when you need structural conformance.
Are external entities or DTDs resolved?
No. The browser DOMParser does not fetch or resolve external entities, external DTD subsets, or remote document references, so this tool is not susceptible to classic XML External Entity (XXE) expansion. Internal entity references that the browser cannot resolve will surface as a parse error rather than being expanded against a network resource.
What does pretty-printing change in my XML?
Pretty-printing re-serializes the parsed DOM with newlines and indentation between elements. Element names, attributes, attribute values, and text content are preserved and re-escaped correctly. Insignificant whitespace between tags is normalized, so if your XML treats whitespace as significant text, prefer the minify or leave-as-is options instead of reformatting.
Does anything I paste leave my browser?
No. Parsing, formatting, and minifying all run locally in JavaScript on this page using the browser's built-in DOMParser and XMLSerializer. Nothing is uploaded, logged, or sent to a server, so it is safe to format configuration files or signed XML payloads.
Does reformatting XML ever change its meaning?
It can, inside elements where whitespace is significant. Pretty-printing adds indentation between elements, so content governed by xml:space="preserve" or held in mixed-content elements should be treated carefully.