XML formatter and pretty printer
Pretty-print XML, SOAP, WSDL and config files with real indentation and attribute wrapping. Parsed by your own browser — nothing is uploaded.
- Runs in your browser
- Files are never uploaded
- Free, no account
Your XML never leaves this tab — check it yourself—
Starting the network probe…
The counter above wraps fetch, XMLHttpRequest and navigator.sendBeacon in this tab and counts every call. It does not block anything — it just reports.
Two ways to verify independently
- Turn off Wi-Fi or enable airplane mode, then use the tool. It keeps working, because the page is already fully loaded.
- Open your browser devtools, switch to the Network tab, clear it, and run the tool. No new row appears.
Why this matters
In 2025 researchers found that popular online formatters had retained tens of thousands of user-submitted snippets — JSONFormatter.org and CodeBeautify together exposed roughly 80,000 saved documents, many containing live cloud credentials, private keys and internal database connection strings, because “format this” quietly meant “upload this”. A separate incident exposed roughly 3.5 million user PDFs on a document-conversion service. The only structural fix is not sending the data in the first place: this site is served under a Content-Security-Policy whose connect-src contains no third-party origin, so a request off this device cannot be made even by accident.
How the formatter decides where to break
Indenting XML sounds trivial until you meet mixed content. This formatter walks the parsed document and applies four rules:
- An element whose children are all elements gets each child on its own line, indented one level.
- An element with a single short text child stays on one line:
<price>44.95</price>. - An element with mixed content — text and elements together — is reproduced exactly as written, because the whitespace between those children is part of the rendered text.
- An element with more attributes than fit comfortably on one line puts each attribute on its own line, which is what makes a WSDL or an Android layout readable.
Rule three is the one that separates a correct formatter from a destructive one. Reflowing
<p>An <em>important</em> note</p> across three lines inserts
whitespace either side of the emphasis and changes what the reader sees. The tool detects the
case, leaves it alone, and tells you it did.
Working with SOAP and WSDL
SOAP envelopes arrive from the wire as one enormous line, which is exactly when a formatter earns its keep. Two things to know:
-
A fragment copied out of a larger envelope will usually fail to parse, because the namespace
prefixes (
soap:,xsi:,wsse:) are declared on the root element you did not copy. Either copy from<soap:Envelope>down, or add thexmlns:declarations to the fragment. -
WSDL documents are attribute-heavy, so the attribute-wrapping rule fires often. That is
deliberate: a
<wsdl:operation>with six attributes on one 200-character line is unreadable.
What is preserved
| Construct | Treatment |
|---|---|
<?xml … ?> declaration | Kept at the top, verbatim |
<!DOCTYPE …> | Kept, including an internal subset |
| Comments | Kept by default, one per line; removable with a switch |
| CDATA sections | Reproduced byte-for-byte, contents untouched |
| Processing instructions | Kept on their own line |
| Attribute order | Unchanged — XML says order is insignificant, diffs disagree |
| Empty elements | Collapsed to <a/> by default; switchable |
| Entity references | Resolved by the parser and re-escaped on output |
The parser is your browser’s
There is no XML library bundled into this page. Parsing uses DOMParser, which is the
same implementation the browser uses for XHR responses, XSLT and fetch. Two
consequences worth knowing: well-formedness here means well-formedness in a real consumer, and
the error messages come from the browser engine, which is why the tool translates them into a
single plain sentence and keeps the raw text behind a disclosure.
Formatting a document you would not upload
XML in the enterprise carries the things people are least willing to paste into a website: SOAP headers with WS-Security tokens, HL7 and FHIR patient records, financial messages, SAML assertions containing an entire identity. All of the processing here happens in this tab. Expand the panel under the tool to watch the request counter, or turn off your network connection and confirm the page keeps working.
Questions
Which parser does this use?
The browser's own XML parser — the same one it uses for XHR responses and XSLT. That means well-formedness here means well-formedness in a real consumer, and no third-party parser is downloaded or bundled.
Why is one of my elements left on a single line?
Because it has mixed content: text and child elements together, as in `<p>An <em>important</em> note</p>`. Whitespace between those children is significant, so re-indenting would change the rendered text. The formatter detects mixed content, leaves it exactly as written, and tells you it did.
Does it validate against a DTD or XSD?
No. It checks well-formedness — tags matched and nested correctly, attributes quoted, entities defined — which is what catches the overwhelming majority of real errors. Schema validation needs the schema itself and is out of scope for a browser tool.
What happens to comments, CDATA and processing instructions?
Comments are kept by default and can be dropped with a switch. CDATA sections are reproduced verbatim, including their contents. Processing instructions and the XML declaration are preserved at the top of the document.
Is it safe to paste a SOAP request with credentials in the header?
Yes. Formatting happens in this tab and there is no network request; you can disconnect from the internet and it keeps working. Expand the panel under the tool to see the live request counter.