XML Formatter

XML is the format that refuses to die. RSS and Atom feeds are XML. SOAP envelopes are XML. Maven POMs, Spring configs, Android layouts, Java EE web.xml, .NET app.config, SVG, sitemap.xml, and the underlying format of every Microsoft Office document (XLSX, DOCX, PPTX) are all XML. Whenever you have to read or modify one of these and the source comes minified or with one element per line, the first thing you want is a clean, indented version where the structure is obvious.

This tool is built around two pieces of the browser. First, **`DOMParser`** validates your input — XML is strict, and the parser will reject unclosed tags, mismatched namespaces, undeclared entities, and malformed CDATA blocks with a clear error message. That validation happens before the formatter touches your document, so a malformed input never gets silently "repaired" into something that looks valid but is not. Second, **`xml-formatter`** (a tiny ~5 KB library) walks the validated document and re-emits it with consistent indentation and a stable choice about when to keep leaf elements on a single line.

The "keep simple leaf elements on one line" option is the difference between readable XML and pyramid-shaped XML. Without it, a feed like `<title>Hello</title>` becomes three lines: `<title>\n Hello\n</title>`. A 50-item RSS feed turns into a 300-line scroll. With it on, leaves stay compact (`<title>Hello</title>`) while structural elements still indent, which matches what Maven, the .NET XML serializer, the Java JAXB pretty-printer, and every major hand-edited XML config does.

Minification is the inverse operation and surprisingly tricky to get right. You cannot just delete all whitespace — text content inside an element is data, and stripping spaces inside `<message>Hello world</message>` changes the message. The minifier here removes whitespace **between tags only** (`> <` collapses to `><`), strips comments, and collapses runs of whitespace outside text content. The result is the smallest representation that parses to the same DOM tree.

A few things the tool deliberately does not do. It does not transform HTML — HTML5 is intentionally not well-formed XML (it allows unclosed paragraphs, self-closing tags without slashes, attribute values without quotes), so the XML parser rejects HTML5 documents. For HTML, use the dedicated HTML/CSS/JS Beautifier instead. It does not sort attributes — order is preserved exactly as the input. XML semantically treats attribute order as unspecified, but compare-by-string-equality workflows depend on stable order, and silently re-ordering would surprise people. It does not resolve external entities, validate against schemas, or fetch DTDs.

One historical hazard worth flagging: **XML external entity (XXE) attacks.** Some XML parsers, when given a document that references an external file via a DTD declaration, will fetch and inline that file — including `/etc/passwd` or an internal URL the attacker could not otherwise reach. The browser's `DOMParser` does not fetch external entities (modern browsers have all blocked this for years), so pasting hostile XML into this tool is safe. But if you are writing server-side code that parses XML, look up "XXE" for your specific library and confirm external entities are disabled by default.

Everything runs in your browser. The XML parser is native; the formatter is ~5 KB of bundled JavaScript. No network requests, no logging, no telemetry on document contents. Internal SOAP traffic, vendor RSS feeds with API keys in URLs, proprietary config files — all stay on your machine.