Encoding Tools
XML URL Encode / Decode
Carry XML through URLs intact — well-formedness checked, percent-encoded, decoded back to formatted markup.
In short
URL-encode XML for transport in query strings — validated for well-formedness first. Decode mode restores and formats the XML. Free and client-side.
By NaveenKumar T · Updated
- Validates XML before encoding
- Decode restores formatted XML
- Exact error positions
Runs entirely in your browser — nothing you paste or open here is uploaded, logged, or stored.How we handle data →
Example
XML URL Encode: input and output
A payment-callback fragment prepared for a query-string parameter.
<callback id="tx-8841">
<status>captured</status>
<amount currency="EUR">49.90</amount>
<note>Réservé & payé</note>
</callback>%3Ccallback%20id%3D%22tx-8841%22%3E%0A%20%20%3Cstatus%3Ecaptured%3C%2Fstatus%3E%0A%20%20%3Camount%20currency%3D%22EUR%22%3E49.90%3C%2Famount%3E%0A%20%20%3Cnote%3ER%C3%A9serv%C3%A9%20%26amp%3B%20pay%C3%A9%3C%2Fnote%3E%0A%3C%2Fcallback%3EAngle brackets became %3C and %3E, quotes %22, line breaks %0A, and the already-escaped & was encoded as %26amp%3B — the value can now ride in a query string without being split at the ampersand.
Learn more
Why XML needs URL encoding
Legacy integrations sometimes pass XML fragments as query parameters — SAML relay states, callback payloads, signed request fragments. Raw markup in a URL is doomed: & starts a new parameter, < may be rejected outright by WAFs. Validation-then-encoding guarantees the fragment arrives parseable.
Decode mode doubles as an inspector for those same integrations: paste the parameter, get formatted XML and a validity verdict in one step.
Debugging SAML and SSO redirects
The most common visitor to this page is mid-SSO-debugging: a SAML redirect failed, the IdP support team wants the request XML, and what you have is a kilometer-long URL with a percent-encoded parameter. Paste the parameter here, decode, and the AuthnRequest appears formatted — issuer, destination, timestamps readable. (If decode reports binary content, the value is the deflate-compressed Redirect binding; POST-binding values decode directly.)
The same loop applies to legacy SOAP gateways, payment-callback fragments, and any enterprise middleware that tunnels XML through query strings — a pattern that should have died but reliably hasn't.
Help
Frequently asked questions
Everything you need to know about the XML URL Encode.
01How do I use XML URL Encode?
Paste XML and Encode for a URL-safe value, or paste an encoded blob and Decode to recover formatted markup. Malformed XML is caught with its exact line and column before encoding.
02My XML has angle brackets everywhere — does that matter for URLs?
It's exactly why encoding is mandatory: <, >, quotes, spaces and ampersands are all unsafe or significant in URLs. Percent-encoding converts every one of them, and Decode brings the same markup back, re-indented for reading.
03Why does the decoded XML look different from what I encoded?
Decoding on XML URL Encode reformats the result with two-space indentation, so a minified single-line fragment comes back as readable markup with text kept on the same line as its tags; it also checks the result for well-formedness. Element names, attributes and text are unchanged — only whitespace between tags moves. If you need the exact original bytes back, decode with the plain URL Encode / Decode tool instead. Encode, by contrast, is byte-exact: your input is encoded as pasted, after trimming.
Keep working
Related tools
URL Encode / Decode
Encoding Tools
XML Formatter
Re-indent any XML document into clean, readable markup — comments and CDATA preserved, validation built in.
Base64 to XML
Decode Base64 payloads to validated, formatted XML — the SAML/SOAP debugging shortcut — or encode XML for transport.
XML Escape
The five XML entities, handled both directions — make any text safe inside elements and attributes.
YAML URL Encode
Encoding Tools
JSON URL Encode
Encoding Tools