XML Validator

Details

About this tool

Checks that XML is well-formed - tags matched and correctly nested, attributes quoted, entities legal, one root element - and reports the first error with its line and column.

Well-formed is a lower bar than valid, and the difference is the reason there are two XML tools here. Well-formed means the document obeys XML's own syntax rules and can be parsed at all. Valid means it also matches a schema: the right elements, in the right order, with the right data types. A document can be perfectly well-formed and still be nonsense for its purpose, which is what the XSD validator is for.

Most failures are one of a handful. An unescaped ampersand - a bare & rather than & - is the classic, and it is why URLs pasted into element text so often break the document. A tag closed out of order, an attribute value without quotes, two root elements, or a stray character before the XML declaration will all stop a parser. So will an unrecognised entity: XML defines only five by name, and anything else has to come from a DTD.

Namespaces are checked as far as syntax goes: a prefix used without being declared is an error, because the parser has no way to resolve it. What is not checked is whether the namespace URI is the one your consumer expects - that is meaning, not syntax, and again a job for a schema.

This runs entirely in your browser. External entities are not resolved and no network request is made from the parser, which closes off the XXE class of attack by construction rather than by configuration.

Good to know

Questions people actually ask

Does this validate XML against XSD?

No - this one checks that the document is well-formed, meaning it parses at all. Checking it against a schema is a different job and has its own tool here, the XML + XSD validator, because conflating the two is how people conclude a document is fine when it merely parses.

Are DTDs and external entities supported?

External entities are deliberately not resolved and no network request is made while parsing. That closes off XXE - the attack where a crafted document makes the parser fetch a local file or an internal URL - structurally rather than by a setting somebody might change.

What does "well-formed" actually mean?

That the document obeys XML's syntax: exactly one root element, every tag closed and correctly nested, attribute values quoted, no bare & or < in text, and any entity either one of the five built-ins or declared. It says nothing about whether the content is the content your system expects.

Why is my ampersand an error?

Because & starts an entity reference in XML, so a bare one leaves the parser waiting for a name and a semicolon. Write &amp; instead. This is why pasting a URL with query parameters straight into element text usually breaks the document - every & in it needs escaping.

Is my XML uploaded?

No. Parsing happens in your browser, so a document with customer data, an invoice or an internal integration payload in it never leaves your device.