XML File (.xml): What It Is, How It Works + Sample Files

The basics

What is an XML file?

An XML file holds information marked up with tags that describe what each piece is: <price currency="EUR">12.50</price>. XML itself defines only the syntax. Each use of it defines its own vocabulary of element and attribute names, which is why XML is called extensible.

You meet XML in many places: sitemaps (sitemap.xml), RSS and Atom news feeds, SVG images, Android layouts, Maven's pom.xml, .NET project and config files, SOAP web services, e-invoicing standards such as UBL, and inside every DOCX and XLSX file, which are ZIP archives of mostly XML files.

Three things XML is not:

Not HTML. HTML has a fixed set of tags and a forgiving parser. XML has no built-in tags and a strict parser that stops at the first error.
Not a format by itself. A .xml extension tells you the syntax, not what the data means. Two XML files can have nothing in common beyond angle brackets.
Not a database. It is text in a file. Querying it means loading it with a parser and using XPath, XSLT or code.

Anatomy

What's inside an XML file

XML is made of elements: a start tag like <item>, the content, and an end tag like </item>. Unlike HTML, there are no predefined tags: each format chooses its own names. Here is a small but complete document, part by part.

order.xml

<?xml version="1.0" encoding="UTF-8"?>
<!-- A small order -->
<order xmlns="urn:example:orders" id="184">
  <customer>Ada Example</customer>
  <date>2026-10-27</date>
  <items>
    <item sku="MUG-01" qty="2">Mug</item>
    <item sku="TEE-07" qty="1">T-shirt</item>
  </items>
  <note>Fish &amp; chips, served &lt;hot&gt;</note>
  <raw><![CDATA[<b>bold</b> & more]]></raw>
  <gift/>
</order>

1<?xml version="1.0" encoding="UTF-8"?>
The XML declaration
Optional, but if it's there it must be the very first thing in the file, before any space or comment. It states the XML version and the encoding.
2
A comment
Ignored by programs reading the data. A comment can't contain two hyphens in a row.
3<order … id="184">
The root element
Every XML document has exactly one element that contains all the others. A second top-level element makes the file invalid.
4xmlns="urn:example:orders"
A namespace
Gives the element names a unique identity, so <order> here can't be confused with an <order> from another vocabulary. The value is an identifier, not an address anything is fetched from.
5id="184"
An attribute
A name and a quoted value on a start tag. Each attribute name may appear only once per element, and their order carries no meaning.
6<customer>Ada Example</customer>
An element with text
Names are case-sensitive: <Customer> closed by </customer> is an error.
7<items> … </items>
Nested, repeated elements
XML has no list type. A list is a parent element with repeated children, which must close in the reverse order they opened.
8& … <hot>
Entity references
< and & can't appear as text, so they are written < and &. XML predefines five such entities: <, >, &, " and '.
9<![CDATA[ … ]]>
A CDATA section
Everything up to ]]> is plain text, so markup characters need no escaping. Useful for code samples or embedded HTML.
10<gift/>
An empty element
A self-closing tag, the same as <gift></gift>. Its presence alone can carry meaning.

The rules

Well-formed and valid: the two levels of correct

A file is well-formed when it follows XML's own syntax rules. It is valid when it also matches a schema that says which elements and attributes are allowed where. Every XML file must be well-formed; validity only matters when a schema exists.

Exactly one root element contains everything else.
Every start tag has a matching end tag, or is self-closing like  .
Elements close in the reverse order they opened: , never .
Names are case-sensitive.
Attribute values are in single or double quotes.
< and & in text are escaped as < and &, or placed in a CDATA section.

One error stops everything

The XML specification calls a well-formedness error fatal: after one, the parser must not continue normal processing. A browser shows an error instead of the data, and a program gets an exception. This is the opposite of HTML, where browsers repair broken markup and carry on.

Schema language	What it is
DTD	Part of XML 1.0 itself, written in a `<!DOCTYPE>` block or a separate `.dtd` file. Limited types; can also declare entities.
XML Schema (XSD)	A W3C standard written in XML, with data types such as dates, decimals and patterns. The most common choice for business formats.
RELAX NG	A simpler schema language with a compact non-XML syntax, used by formats such as ODF and DocBook.

Mixing vocabularies

Namespaces: why XML files have xmlns attributes

When one document mixes vocabularies, two of them may use the same name. A namespace is a URI attached to element names that keeps them apart. xmlns="…" sets the default namespace for an element and everything inside it; xmlns:dc="…" binds a prefix, so <dc:title> belongs to the Dublin Core vocabulary while a plain <title> belongs to the default one.

The URI is a name, not a link. XML parsers don't fetch it. http://www.w3.org/2000/svg identifies SVG; nothing has to be at that address.
The prefix doesn't matter, the URI does. <dc:title> and <x:title> are the same element if both prefixes point to the same URI.
The usual cause of empty query results. If a document has a default namespace, an XPath expression like //title finds nothing; the query has to use the namespace too.

Characters

Character encoding and the byte order mark

Every XML parser must read UTF-8 and UTF-16. Without a byte order mark (BOM) or an encoding declaration, a parser assumes UTF-8. A file in any other encoding must say so, usually in its declaration, such as <?xml version="1.0" encoding="ISO-8859-1"?>, or else in the server's Content-Type header.

UTF-16 needs a BOM. The bytes FF FE (little-endian) or FE FF (big-endian) at the start tell the parser the byte order. sample-utf16.xml below starts with FF FE.
A UTF-8 BOM (EF BB BF) is allowed but not needed. RFC 7303 recommends UTF-8 without one.
When sources disagree, RFC 7303 makes the BOM win, then the charset in the HTTP Content-Type header, then the declaration in the file.
text/xml and application/xml are now aliases with the same rules. Formats built on XML get their own types ending in +xml, such as image/svg+xml and application/atom+xml.

Comparison

XML vs JSON, and formats built on XML

JSON replaced XML for most web APIs because it maps directly onto the objects and lists in programming languages. XML remains the better fit for documents and for industries with long-established XML standards.

	XML	JSON
Comments	Yes	No
Attributes and mixed text with markup	Yes	No
Namespaces for mixing vocabularies	Yes	No
Built-in data types	None: everything is text until a schema says otherwise	String, number, boolean, null
Schemas	DTD, XSD, RELAX NG; long established	JSON Schema
Querying and transforming	XPath, XQuery, XSLT	jq, JSONPath, code
Size of the same data	Larger: every name appears in a start and an end tag	Smaller

Common formats that are XML inside
Format	Where you meet it
SVG	Vector images on the web.
RSS and Atom	News and podcast feeds.
XHTML	HTML written to XML rules.
DOCX, XLSX, PPTX, ODT	Office documents: ZIP archives of XML parts.
`sitemap.xml`	Lists a site's pages for search engines.
KML, GPX	Map places and GPS tracks.
XSLT, XSD	Transformations and schemas, themselves written in XML.

How to

How to open, edit, validate and convert an XML file

View it: drag it into a browser. Chrome, Edge and Firefox show an XML file without a stylesheet as a collapsible tree, and show an error message with a line number if the file is not well-formed.
Edit it: any code editor works; VS Code with an XML extension adds validation and formatting. Keep the encoding the declaration states.
Check it on the command line: xmllint --noout file.xml reports well-formedness errors, xmllint --noout --valid file.xml also checks it against its DTD, and xmllint --format file.xml pretty-prints it.
Query it: xmllint --xpath '//title/text()' file.xml runs an XPath expression. Most languages have an XPath library.
Convert it: XSLT transforms XML into other XML, HTML or text. There is no single correct conversion to JSON, because attributes, repeated elements and mixed content have no direct JSON equivalent.
Open it as a table: Excel for Windows can load XML with Data, Get Data, From File, From XML, as long as the structure is a fairly flat list of records.

Security

Is XML safe? XXE and entity expansion

Opening an XML file in a browser or editor is safe. The risk is on servers and in apps that parse XML from untrusted sources, because a DTD inside the document can tell the parser to do more than read text:

XML External Entity (XXE) injection. A DTD declares an entity whose value comes from a file or URL, such as file:///etc/passwd, and the document uses it. A parser that resolves it puts the file's contents into the data, which may then be shown or returned to the attacker. Pointing it at an internal address turns the parser into a tool for server-side request forgery (SSRF).
Entity expansion ("billion laughs"). Entities defined in terms of other entities, ten times over at each level, expand a file of a few hundred bytes into gigabytes of text and exhaust memory.

How to prevent it

If your application doesn't need DTDs, disable them in the parser. Otherwise disable external entities and limit entity expansion. Defaults differ by parser and version: libxml2 has not loaded external entities by default since version 2.9, while some Java and older .NET parsers needed explicit settings. In Python, the defusedxml package rejects these constructs; it refuses sample-dtd.xml below because that file declares an entity. The OWASP XXE Prevention Cheat Sheet lists the settings for each parser.

Free downloads

Sample XML files to download

Free sample XML files for testing parsers, uploads, encodings, DTD handling and size limits. Each one is well-formed XML 1.0, checked with libxml2 and Python's parsers.

sample-catalog.xml · 2.6 KBDownload Open

Loading…

What's inside sample-catalog.xml

The file is commented: open it in a text editor and each numbered comment marks one of these parts.

Comment 1: the declaration
<?xml version="1.0" encoding="UTF-8"?> is the first line, with nothing before it, as the specification requires.
Comment 2: a processing instruction
<?sample-app mode="test"?> is a note for one particular program. Software that doesn't recognise it ignores it.
Comments 3 and 4: root and namespaces
One root element, <catalog>, with a default namespace, the Dublin Core namespace bound to the dc: prefix, and xml:lang.
Comments 5 and 6: attributes and lists
Each <book> has an id and an available flag as attributes; its tags form a list as repeated <tag> elements.
Comments 7 and 8: escaping
& and < in a title, and €, a character reference for the euro sign, inside an attribute value.
Comments 9 and 10: mixed content and CDATA
A summary with  elements inside running text, and a code snippet in a CDATA section, where < and && need no escaping.
Comments 11 and 12: an empty element and language
A self-closing <cover/>, and a Dutch book whose xml:lang="nl" overrides the document's language.

All sample XML files

Commented sample catalogue
sample-catalog.xml · 2.6 KB (2,634 bytes)
A small book catalogue that uses the declaration, a processing instruction, two namespaces, attributes, entities, a character reference, mixed content, CDATA and an empty element, with numbered comments explaining each.
- Teaching the parts of an XML file
- Testing namespace-aware parsing and XPath
Download Open
Minimal XML document
sample-minimal.xml · 66 bytes
A declaration and a single root element containing text.
- Parser smoke tests
- Content-type and upload checks
Download Open
Document with an internal DTD
sample-dtd.xml · 898 bytes
A contact list that is valid against the DTD inside it, including an ID attribute, an enumerated attribute with a default, and one harmless internal entity (&site;).
- DTD validation with `xmllint --valid`
- Checking whether a hardened parser rejects DTDs and entities
Download Open
UTF-16 encoding test
sample-utf16.xml · 1.6 KB (1,628 bytes)
Greetings in 12 languages, including right-to-left Arabic and Hebrew, saved as UTF-16 little-endian with a byte order mark (FF FE).
- Testing encoding detection
- Pipelines that assume every file is UTF-8
Download Open
1 MB XML file
sample-1mb.xml · 1 MB (1,048,576 bytes)
6,398 fictional records, padded with a comment to exactly 1,048,576 bytes (1 MiB).
- Upload and size-limit tests
- Parser performance
Download Open

Ways to test with them

Size limits: sample-1mb.xml is exactly 1,048,576 bytes, so you can test a limit right at the boundary.
Parser hardening: feed sample-dtd.xml to an endpoint that accepts XML. A parser configured to forbid DTDs should reject it; if it returns the contact named Sample from 99helpers.com/file-types/xml, entities are being expanded.
Namespaces: query sample-catalog.xml for book titles. A query that ignores the default namespace returns nothing, a common bug.
Encoding: sample-utf16.xml should read exactly like a UTF-8 file. Garbled text or a parse error at the first byte means a step assumed UTF-8.

Free to use for testing, teaching and demos, commercially or not, with no attribution needed. A link back to this page is always appreciated.

Put it online

Have an XML file? Give it a link.

Drop an XML file on 99helpers and it gets its own web address. Browsers display it, and feed readers, scripts and other systems can fetch it straight from the link.

Put an XML file online

Questions

XML files, frequently asked

What does XML stand for?

Extensible Markup Language. Extensible because you define your own tags, markup because the tags are added around the text to describe it.

How do I open an XML file?

Drag it into a browser to read it as a tree, or open it in any text or code editor to edit it. Programs that use a particular XML format, such as a feed reader for RSS, open it as that format.

Why does my browser say the XML has no style information?

It's not an error. The file has no stylesheet telling the browser how to display it, so the browser shows the raw document tree instead.

What's the difference between XML and HTML?

HTML has a fixed set of tags for web pages and a forgiving parser. XML has no predefined tags, is used for data and documents of any kind, and must follow its rules exactly or it won't load.

What's the difference between well-formed and valid XML?

Well-formed means the file follows XML's syntax rules. Valid means it also matches a schema (a DTD, XSD or RELAX NG) that defines which elements and attributes are allowed.

Should I use XML or JSON?

JSON for most web APIs and app data. XML when you need mixed text and markup, namespaces, or when an industry standard (invoicing, publishing, office files) is already XML.

What is XXE?

XML External Entity injection: a document's DTD tells the parser to read a local file or fetch a URL and include the result. Prevent it by disabling DTDs or external entities in the parser.

Is text/xml or application/xml correct?

Both. Since RFC 7303 (2014), text/xml is an alias of application/xml with the same encoding rules. application/xml is the main registration.

Related formats

Other file types explained

JSON file HTML file SVG file XLSX file DOCX file All file types

Keep going

Host an XML file

Put an XML file online at its own address in seconds.

Share an XML file

Send XML as a link instead of an attachment.

Host a website

Put a folder of pages, feeds and sitemaps online.

Sources

Last reviewed 27 October 2026.