XML Formatter

XML (eXtensible Markup Language) is the W3C-standardized text format for hierarchical data: a tree of elements, attributes, and text nodes serialized with angle-bracketed tags. It still powers SOAP web services, RSS and Atom feeds, SVG, Office Open XML (.docx, .xlsx), Android manifests, Maven pom.xml, Spring application context files, and SAML assertions. JSON has displaced it for many APIs, but XML's schema strength and namespace model keep it dominant in enterprise integration.

Validation in this tool is done by the browser's built-in DOMParser API. Calling parser.parseFromString(xml, 'application/xml') runs the same XML 1.0 conformant parser the browser uses for SVG and XHTML; if the input is malformed it returns a document containing a parsererror element instead of throwing. The tool inspects that element and surfaces the message — typically a one-line description of the line and column where the problem occurs.

Beautification is a deliberately small custom function rather than a full parser-driven pretty-printer. It collapses whitespace between tags, splits on tag boundaries, and re-indents based on whether each token is an opening tag, closing tag, self-closing tag, or processing instruction. This keeps the bundle small and works on most well-formed XML. The trade-off is that it does not preserve significant whitespace inside text nodes (xml:space="preserve") and does not normalize attribute order — for that, you would need a real XML library.

The XML-to-JSON converter walks the DOM produced by DOMParser and applies a common heuristic: attributes become @-prefixed keys (@name), text content becomes #text, and repeated child elements become arrays. This is a pragmatic mapping and not the only one — the BadgerFish convention prefixes with $ instead of #, the Parker convention drops attributes entirely, and JSONx uses a verbose envelope. There is no canonical XML-to-JSON because XML carries information (attributes vs elements, ordering, namespaces, comments) that JSON cannot represent without invention.

Two security pitfalls are worth flagging. XML External Entities (XXE) are a class of attack where a malicious XML document declares an external entity (<!ENTITY xxe SYSTEM "file:///etc/passwd">) that a misconfigured parser then fetches and inlines. Modern browsers' DOMParser does not resolve external entities by default, so this tool is safe — but server-side parsers in Java, Python, and PHP often need explicit configuration to disable DTD processing. Second, the billion laughs attack uses recursive entity expansion to balloon a small input into gigabytes; again, browser DOMParser is hardened, but not all libraries are.

When working with namespaced XML (xmlns attributes), keep the prefixes meaningful and consistent. The DOM API exposes namespace URIs separately from local names; the JSON converter here flattens both to a single key, which is fine for round-tripping XML you control but loses information when handling SOAP envelopes or Atom feeds with multiple namespaces. For lossless round-trips, keep the data in DOM form or use a library like xmlbuilder2.

Everything happens in your browser. Input never leaves the page, validation runs through DOMParser locally, and the JSON conversion is a synchronous walk over the parsed DOM tree. Closing the tab discards your input.