XML Decoder
Paste XML and read its structure: the declaration, the DOCTYPE and any entities, the element tree with namespaces and attributes, plus a security check of the XML attack surface. Nothing is fetched or resolved.
Security & WAF🔒 Parsed entirely in your browser. No entity is resolved, no external reference is fetched, and nothing is uploaded.
The structure is parsed entirely in your browser from the XML you paste. The parser is a text tokenizer that never resolves an entity, never dereferences a SYSTEM or PUBLIC identifier, and never fetches anything; external entities are reported as the literal reference they declare, not their contents. Every part is labelled against the XML 1.0 grammar and the Namespaces in XML rules, and the security analysis flags the entity attack surface without exercising it.
- W3C XML 1.0The XML 1.0 grammar: declaration, elements, attributes, DOCTYPE, entities, CDATA
- W3C Namespaces in XML 1.0Namespace prefixes, the default namespace, and prefix resolution
- OWASP XXE Prevention Cheat SheetExternal entities, parameter entities, and entity expansion as attack vectors