search⌘KtranslateENexpand_moreupload_fileConvert

XML Formatter

XML is strict about syntax and dangerously generous about entities

One unescaped ampersand and a conforming parser must stop; that’s well-formedness. A DOCTYPE can also define entities that expand into other entities or pull in files from disk, which is how billion-laughs and XXE attacks work. Namespaces then make the same tag name mean different things. This page parses with your browser’s own XML parser, then shows the encoding, the namespace-resolved tree, live XPath, entity expansion and Canonical XML hashing.

folder_openOpen .xmlInvoice with namespacesHostile: bomb + XXEBroken export

invoice.xml · 916 bytes · parsed in 0.2 ms

check_circleWell-formed XML

15 elements, 9 attributes and 4 namespaces, parsed by your browser in 0.2 ms.

<?xml version="1.0" encoding="UTF-8"?><invoice xmlns="urn:example:invoice:2" xmlns:addr="urn:example:address" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:example:invoice:2 invoice.xsd" number="INV-2026-0417" currency="EUR" xml:lang="de">

first bytes3C 3F 78 6D

detected from bytes<?xm, read declaration

declaredUTF-8

decoded asUTF-8 · valid

namespace-resolved tree26 of 26 nodes · 13 whitespace-only text nodes hidden

<?xml-stylesheet?>type="text/xsl" href="invoice.xsl"

exported 2026-10-04 by FileFormer

<invoice>xmlns="urn:example:invoice:2" xmlns:addr="urn:example:address" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:example:invoice:2 invoice.xsd" number="INV-2026-0417" currency="EUR" xml:lang="de"{urn:example:invoice:2}invoice

<issued>{urn:example:invoice:2}issued

#text"2026-10-04"

<seller>{urn:example:invoice:2}seller

<name>{urn:example:invoice:2}name

#text"Ölmühle Köln GmbH"

<addr:address>addr:type="billing"{urn:example:address}address

<addr:street>{urn:example:address}street

#text"Venloer Straße 12"

<addr:city>{urn:example:address}city

#text"Köln"

<line>sku="A-1" qty="2"{urn:example:invoice:2}line

<desc>{urn:example:invoice:2}desc

#text"Espresso & Milch"

<price>{urn:example:invoice:2}price

#text"3.49"

<line>sku="B-7" qty="1"{urn:example:invoice:2}line

<desc>{urn:example:invoice:2}desc

CDATA"Gift card <50 €> & wrapping" · read as plain text

<price>{urn:example:invoice:2}price

#text"50.00"

<note>{urn:example:invoice:2}note

#text"Payable within 14 days: thank you."

<empty>{urn:example:invoice:2}empty

916 Bfile size

15elements

9attributes (not counting xmlns)

4namespaces in use

4deepest nesting

13whitespace-only text nodes

namespaces in scope

(default)urn:example:invoice:2 · 12 element/attribute names use it

addrurn:example:address · 4 element/attribute names use it

xsihttp://www.w3.org/2001/XMLSchema-instance · 1 element/attribute names use it

xmlhttp://www.w3.org/XML/1998/namespace · built in, never declared · used 1×

check_circleWell-formed.Your browser’s XML parser built the whole tree in 0.2 ms.

check_circleEncoding.Decoded as UTF-8 (<?xm, read declaration, declared UTF-8); every byte valid.

check_circleNo DOCTYPE.No DTD, so no custom entities and no default attribute values. Most modern XML has none. Version 1.0.

check_circleEntity expansion.Only the five predefined entities and character references can appear, so expansion is at most a few bytes each.

check_circleNo external entities.Nothing in this file asks a parser to read another file or URL.

check_circleNamespaces.Default namespace urn:example:invoice:2 applies to unprefixed elements, but not to unprefixed attributes. XPath needs a prefix for it (see the lab).

XPath lab · document.evaluate on the loaded file

The default-namespace trap

In XPath 1.0 an unprefixed name means “no namespace”. So once a document declares xmlns="…", //invoice matches nothing even though the tag says invoice. You have to bind a prefix to the URI and write //inv:invoice. The prefixes below are taken from the file, plus inv: for its default namespace.

//invoice//inv:invoice//inv:issued//addr:address//*[local-name()='invoice']count(//*)//comment()//text()[normalize-space()]

bound: addr → urn:example:address · xsi → http://www.w3.org/2001/XMLSchema-instance · xml → http://www.w3.org/XML/1998/namespace · inv → urn:example:invoice:2

0 nodes. In XPath 1.0 “invoice” means invoice in no namespace, but this file puts it in urn:example:invoice:2. Try inv:invoice.

as typed0 nodes//invoice

-No node in the file matches.

with inv: on unprefixed names1 nodes//inv:invoice

/invoice[1]2026-10-04 Ölmühle Köln GmbH Venloer Straße 12 Köln Espresso & Milch3.49 Gift card <50 €> & wrapping50.00 Payable within 14 days: thank you.

entity lab · computed, then tested on your browser

How 400 bytes become gigabytes

Each level of the billion-laughs DTD repeats the previous entity ten times. The page works out the expanded size arithmetically rather than expanding it. It then hands your browser a safe three-level version and a document with an external SYSTEM entity, to see what its parser really does.

levels: 9 · copies per level: 10fan-out

<?xml version="1.0"?><!DOCTYPE lolz [ <!ENTITY lol0 "lol"> <!ENTITY lol1 "&lol0;&lol0;&lol0;&lol0;&lol0;&lol0;&lol0;&lol0;&lol0;&lol0;"> <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;"> <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"> <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"> <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"> <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"> <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;"> <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;"> <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">]><lolz>&lol9;</lolz>

804 Bdocument as written

3.0 GBtext after expansion

×3.7e+6amplification

Internal entities: expandedYour browser expanded &lol3; into 3,000 characters in 0.4 ms. Internal entities are part of the language; the danger is only in how far they multiply.

External SYSTEM entity: not loadedThe element text is “[]”: your browser kept the reference and read nothing from file:///etc/hostname. A server parser with external entities on would paste the file in here. That is XXE.

Your setting: not runExpanding to 3.0 GB could freeze this tab, so the page stops at 3 MB. Parsers such as expat 2.4+ and recent libxml2 refuse documents whose amplification passes a fixed limit; older or misconfigured server parsers just keep allocating.

canonical XML lab · what XML signatures actually hash

Different bytes, same document, same hash

Attribute order, quote style, empty-tag shorthand, character references and CRLF don’t change what an XML document means, so XML-DSig signs a canonical form instead (C14N 1.0). This page writes that form itself: attributes sorted by namespace and name, namespace declarations first, <a/> expanded to <a></a>, text escaped one fixed way. Then it hashes it with SHA-256. Edit either side.

<order xmlns="urn:shop" currency="EUR" id="42"> <item qty="2" sku="A-1"></item> <note>café &amp; bar</note></order>

c14n sha-256 83db40aa68ad3d62adb1f0feeb8923d96d614e4aaa99665a4f87caf32147556f

<order xmlns="urn:shop" currency="EUR" id="42"> <item qty="2" sku="A-1"></item> <note>café &amp; bar</note></order>

c14n sha-256 83db40aa68ad3d62adb1f0feeb8923d96d614e4aaa99665a4f87caf32147556f

Both sides canonicalise to the same 121 bytes, so the SHA-256 matches and one XML signature verifies both. The raw files hash differently (first 16 hex: 198f6fa3cc4b2ea3 vs ed2e6bbc367e4fae).

Reference

first bytesmeansnotes

EF BB BFUTF-8 with BOMAllowed; the declaration, if present, must agree. Old tools show it as ï»¿.

FE FFUTF-16 BEXML 1.0 §4.3.3: UTF-16 entities must begin with the byte order mark.

FF FEUTF-16 LEWhat Windows tools save as “Unicode”. Also needs the BOM.

00 00 FE FFUTF-32 BEListed in Appendix F; browsers have no UTF-32 decoder.

3C 00 3F 00UTF-16 LE, no BOMNot conforming, but Appendix F tells parsers how to spot it.

00 3C 00 3FUTF-16 BE, no BOMSame: detectable, not conforming.

3C 3F 78 6D<?xmASCII-compatible; read encoding= in the declaration to learn which one.

4C 6F A7 94<?xm in EBCDICIBM mainframe exports; the declaration names the code page.

otherno declarationMust be UTF-8 (or UTF-16 with BOM) unless HTTP charset says otherwise.

specwhat it adds

XML 1.0 5th ed.2008. The grammar: well-formedness, DTDs, entities, encodings, line-end and attribute-value normalisation.

XML 1.1 2nd ed.2006. Allows C0 controls as character references and NEL line ends. Rarely implemented; most files stay 1.0.

Namespaces 1.03rd ed., 2009. xmlns and xmlns:p bind prefixes to URIs; names become {URI}local pairs.

Infoset2004. The abstract model a parser reports, independent of quotes, attribute order or entity use.

XPath 1.01999. Path language behind XSLT 1.0 and document.evaluate in browsers.

XSLT 1.0 / 3.01999 / 2017. Transformations. Browsers shipped 1.0 via XSLTProcessor; Chrome announced in 2025 that it will remove it.

XML Schema1.0 in 2001, 1.1 in 2012. Types, cardinality, keys. Most validators still implement 1.0.

Canonical XMLC14N 1.0 (2001), Exclusive C14N (2002), 1.1 (2008). Byte-exact output for hashing and signing.

XML Signature1.1, 2013. Enveloped signatures used by SAML, e-invoicing and many government formats.

MIMEapplication/xml (RFC 7303); text/xml is treated the same. Vocabularies use the +xml suffix: image/svg+xml, application/atom+xml.

Extension.xml, plus vocabulary-specific ones: .svg, .xsd, .xsl, .kml, .gpx, .plist, .rss, .xliff.

Magic bytesNone required. A file can start with <?xml (3C 3F 78 6D), a BOM, a comment or straight with the root tag.

CharactersXML 1.0 forbids U+0000 and most C0 controls, even as . Only tab, LF and CR are allowed below U+0020.

Line endsCRLF and lone CR become LF before parsing, so text only contains CR if written as .

NamesCase-sensitive. Names beginning with “xml” in any case are reserved for W3C specs.

EntitiesOnly five are predefined: < > & " '. HTML names such as   are a fatal error without a DTD.

ErrorsFatal errors are final: after the first one a parser must stop passing normal data to the application.

1986SGMLISO 8879. XML is a simplified profile of it.

1998XML 1.0W3C Recommendation, 10 February.

1999Namespaces, XPath, XSLTThe three specs that made XML practical to mix and query.

2001Schema and C14NXML Schema 1.0 and Canonical XML 1.0.

2002XML SignatureXML-DSig becomes a Recommendation; later the base of SAML.

2006Office goes XMLODF becomes ISO 26300; ECMA-376 (OOXML) is approved.

20085th editionXML 1.0 widens the allowed name characters; still current.

Formats built on XML

SVG formatAn XML vocabulary browsers draw. Same entity and external-reference risks, plus scripts.<svg onload="…">arrow_forwardflagged active content DOCX formatA ZIP of XML parts. Formatting comes from a cascade across styles.xml and document.xml.<w:r><w:b/>arrow_forwardresolved: bold 11 pt XLSX formatSpreadsheets as XML: shared strings, cached formula results and hidden sheets.<c t="s"><v>4</v></c>arrow_forwardcell text from sharedStrings EPUB formatAn OPF package and XHTML chapters, checked reference by reference.content.opf spinearrow_forwardreading order JSON FormatterThe other tree format: no namespaces, attributes, comments or entities.<qty>2</qty>arrow_forward"qty": 2 Hash GeneratorSHA-256 of raw bytes. For signed XML, hash the canonical form instead.invoice.xml bytesarrow_forwardSHA-256 digest

sourcesW3C XML 1.0 (5th ed.)Namespaces in XML 1.0 XPath 1.0 Canonical XML 1.0 RFC 7303 XML media types OWASP XXE prevention