Convert XML to JSON — attributes become "@" keys, repeated elements become arrays, and numeric or boolean text optionally becomes real types. DTDs are rejected by design, so untrusted XML is safe to paste.
Show calculation steps
Processed privately in your browser — nothing you paste is uploaded, logged or stored.
XML unwrapped, safely
Paste XML — a SOAP response, a feed, a legacy export — and get JSON: attributes as @name keys, repeated elements as arrays, text content as values, with numeric and boolean text optionally becoming real types. Security is structural, not optional: the parser rejects DOCTYPE/DTD declarations outright, which eliminates the XXE and entity-expansion attack classes before they can start. Untrusted XML is safe to paste — and it never leaves your browser.
Worked example
<order id="ORD-2041">
<item><sku>K-88</sku><qty>1</qty></item>
<item><sku>M-12</sku><qty>3</qty></item>
</order>becomes:
{
"order": {
"@id": "ORD-2041",
"item": [
{ "sku": "K-88", "qty": 1 },
{ "sku": "M-12", "qty": 3 }
]
}
}Limitations to know
- The one-item ambiguity is fundamental: a single child element converts to an object, not a one-item array — check fields you expect to be lists.
- DTD-declared entities are not supported (that is the safety trade); the five standard entities and numeric references work.
- Namespaces come through as literal prefixed names (
ns:tag), not resolved.
Common errors and fixes
- “DOCTYPE declarations are not supported” — delete the <!DOCTYPE …> line and convert; the document data does not need it.
- IDs lost leading zeros — turn off type coercion so “007” stays a string.
- Mismatched tag errors — the message names both tags and the position; fix the source XML.
How to use the XML to JSON Converter
- Paste XML into the input panel.
- Choose whether numeric/boolean text becomes real JSON types.
- Click "Convert to JSON".
- Attributes appear as "@name" keys; repeated elements become arrays.
Frequently asked questions
Is it safe to paste untrusted XML?
Yes — this parser rejects DOCTYPE/DTD declarations outright, which removes the XXE and entity-expansion attack classes by design, and it runs entirely in your browser. If your XML has a harmless DOCTYPE line, delete it and convert.
How do attributes and text content come through?
Attributes become "@name" keys and mixed text becomes "#text" — the common convention. An element with only text becomes just its value.
Why is a single child not an array?
The classic XML→JSON ambiguity: one <item> converts to an object, two convert to an array — the converter cannot know a lone element was meant as a one-item list. Check fields you expect to be arrays and wrap where needed.
What does type coercion do?
Text like "42", "true" or "null" becomes real JSON numbers, booleans and nulls (long digit strings stay strings to protect precision). Turn it off to keep everything as text — safer for IDs and postcodes with leading zeros.
