Articles · Developer Tools
Format, validate, and query XML without loading a DTD
XML still carries configs, SOAP samples, RSS, and vendor payloads that arrive as one long line. A missing closing tag is enough to stall a client. A formatter that pretty-prints without rewriting text, reports the first well-formedness error, and can jump to that line is faster than counting brackets in a minified dump. Minify is the other direction: a compact fixture. A tree is how you copy /catalog/book[1]/title without inventing an XPath by hand. An XPath tester that lists matches on the same page saves a round trip through an IDE.
Why this is worth doing in the browser
Desktop editors highlight well and still leave XXE as a default in older stacks. Online formatters often upload the document and parse it with DTD processing on. The DevNestro XML Formatter, Validator & Viewer keeps the work in this browser. Paste or upload a .xml or .txt file up to the configured size; oversized files are rejected, not truncated. Choose 2 spaces, 4 spaces, or tabs. Format, validate, or minify. DOCTYPE, ENTITY, XInclude, and external stylesheets are rejected so a file:/// or http entity cannot load. Unknown entities other than lt, gt, amp, apos, quot, and numeric references fail closed. Search names, values, or paths. Copy XPath from the tree. Test /root/item, //title, @id, [1], or [@id='value']. document() and script extensions are blocked. Convert to JSON hands the payload to the Universal Data Converter instead of a second engine. Large XML reduces highlighting so the tab stays usable.
How to use the tool
Paste or upload the document you actually have. Validate first if you only need to know whether it is well-formed. Format when you want indented output. Open the tree to copy an XPath or a value. Run the XPath tester to list matches. Download uses a sanitized local filename and does not upload the file.
- Paste the payload you received, not a guessed subset, and keep namespaces as they arrived.
- Treat a DTD error as a security stop, not as a prompt to enable external entities.
- Copy XPath from the tree instead of typing it, then test it on the same document.
- Use Convert to JSON only after the XML validates; the converter reuses the same DTD ban.
- Clear the editor if the document should not stay on screen.
Privacy
Formatting, validation, search, XPath, and downloads run in the current browser. XML is not uploaded to DevNestro, not stored as a catalogue of documents, and not sent to analytics. There is no account.
Stop hunting a mismatched tag in a minified line. Open the XML Formatter, validate, pretty-print, copy an XPath, and keep DTDs off.