XML Decoder
Paste XML and read its structure: the declaration, the DOCTYPE and any entities, the element tree with namespaces and attributes, plus a security check of the XML attack surface. Nothing is fetched or resolved.
Security & WAF🔒 Parsed entirely in your browser. No entity is resolved, no external reference is fetched, and nothing is uploaded.
API endpointGEThttps://ronutz.com/api/v1/xml-decoderDocumented, not served. Opens the specification.