What is an XML file?

XML is a plain-text format you can open in any editor. It is used for moving data between programs.

The extension is .xml, and the full name is Extensible Markup Language. Both matter less than what the file can hold, which is what the rest of this page is about.

W3C published it in 1998. The specification is XML 1.0.

A format that has been readable for that long is a format worth trusting with something you want back in ten years.

It is published in full, so anyone can implement it from the document rather than by inspection, which is why it turns up in so many programs and why files written twenty years ago still open. A published specification is not the same thing as a royalty-free one: where a format wraps a codec, the patent licensing is a separate question the standard does not settle.

XML stores its content exactly. Saving it again changes nothing, so it can be opened, edited and re-saved as often as you like without accumulating damage — which is what makes it a working format rather than a delivery one.

XML has a comment syntax, which is the difference between a file a person maintains and one a program writes. Comments are the first thing lost converting to a format without them, and nothing warns you.

Visual Studio Code and oXygen XML Editor read it, and so do most programs of the same kind.

If a file will not open, the format is rarely the problem — it is more often that the program predates it. Converting to something older is the reliable way past that, and it is what the rest of this site is for.

Every current browser reads it.

That makes it a safe thing to put on a page or attach to a message without wondering what the other end has installed.

XML is meant to be opened and changed. Keep the file in this format for as long as the work is going on, and export from it whenever a finished copy is needed.

XML does not describe anything by itself. It is a set of rules for marking up a document with nested elements and attributes, and the meaning comes from whatever vocabulary is built on top — RSS, SVG, SOAP, XBRL, HL7, sitemap files, Android layouts, the innards of every Office and OpenDocument file.

So "an XML file" says as much about the contents as "a text file" does. What matters is which vocabulary it follows, and that is usually declared in the root element or by a schema the document points at.

Well-formed means the syntax is correct: one root element, every tag closed, elements properly nested, attributes quoted, and `&` and `<` escaped wherever they are meant as text. The other three reserved characters are narrower than they are usually taught: `>` has to be escaped only inside `]]>`, and the quotes only where they would end the attribute they sit in. A parser refuses anything less — XML is deliberately strict, and unlike HTML there is no error recovery.

Valid means additionally conforming to a schema: this element may contain those elements, this attribute is required, this value must be a date. A document can be perfectly well-formed and completely wrong for its purpose, and a validating parser is what catches the difference. In regulated exchange that validation is the contract, which is most of why XML is still where it is.

Namespaces exist so two vocabularies can be combined without their element names colliding — an XHTML table and a furniture catalogue’s table in the same document. A namespace is identified by a URI, which is a name and not an address: nothing is fetched from it, and it does not have to resolve to anything.

They are also the single largest source of XML parsing bugs. A query written for an element without accounting for its namespace matches nothing, silently, and the document looks fine to a human reading it. If a parser insists a document has no such element while you are looking straight at it, the namespace is the first place to check.

The first line of a well-behaved XML file declares the version and the character encoding. Unlike a plain text file, this makes the encoding part of the document rather than a guess — which is why XML handles international text more reliably than CSV or INI ever have.

Two consequences worth knowing. A file declaring one encoding and saved as another is broken in a way that produces confusing parse errors rather than visibly wrong characters. And a byte order mark ahead of the declaration upsets some parsers, so "UTF-8 without BOM" is the setting to prefer here as elsewhere.

XML has a mechanism for defining shorthand — an entity — and classically it could point at an external resource. A parser that resolves those will read local files or make network requests on behalf of whoever supplied the document.

That is the XXE vulnerability, and it has produced real breaches by exposing server files through an ordinary-looking upload. A related trick, the billion laughs attack, nests entity definitions so that a small file expands to gigabytes and exhausts memory. Whether external entities are resolved by default varies by library rather than being settled — Java’s built-in parsers and Python’s lxml both resolve them unless told not to — so this is a setting to check rather than assume. Any XML arriving from outside is untrusted input.

XPath addresses any part of a document with a compact expression, and it is genuinely excellent — a single line pulls every price element inside a product whose category attribute matches. XSLT transforms one XML document into another, or into HTML or text, declaratively. XSD defines and enforces a schema. All three are standards, all three are mature, and JSON’s equivalents arrived later and are less uniformly supported.

This is what people mean when they say XML is verbose but capable. The angle brackets are the price; the query, transformation and validation machinery is what is being bought, and in the industries that need it there is still nothing quite equivalent.

Any text editor opens it, and an editor with XML support is worth having: it will collapse sections, check well-formedness as you type, and pretty-print a file that arrived as one enormous line — which is how machine-generated XML usually arrives. Browsers also render XML as a collapsible tree, which is the quickest way to look at an unfamiliar file.

Converting to JSON is common and lossy in one direction: attributes have no JSON equivalent and get an invented key name, and mixed content — text with markup inside it — has no representation at all. Data-shaped XML converts cleanly; document-shaped XML does not survive the round trip. Converting to CSV works only where the document is really a flat list of records wearing angle brackets.