JSON ↔ YAML ↔ XML converter — any direction
Convert between JSON, YAML and XML in any direction, with the source format detected automatically and parse errors reported with a line and column.
Runs in your browser — your input is not uploaded to ToolsNow.
The text you enter is processed locally in your browser and is not uploaded to ToolsNow.
Conversions do not always round-trip. The three formats do not describe the same things. XML has attributes and namespaces that JSON and YAML have no native equivalent for, so attributes are mapped to prefixed keys — a convention, not a standard, which is why the prefix is adjustable above. A single repeated XML element becomes a one-item array only if the parser can tell it repeats, so <a><b/></a> and<a><b/><b/></a> convert differently. YAML comments and anchors are lost, because neither JSON nor XML can carry them.
On parsing safety: XML external entities are refused outright by the parser, so the XXE and entity-expansion attacks that classic XML parsers are vulnerable to cannot run here. YAML is parsed with the core schema, so tags like !!js/function resolve to ordinary strings rather than being instantiated. Both behaviours are covered by automated tests, so a dependency update that weakened them would fail the build.
How to use
- Paste your data. The source format is detected as you type; override it if the guess is wrong.
- Pick the target. Any of the three, in any direction. Output updates live.
- Adjust XML handling. When XML is involved, choose how attributes, text nodes and the root element are named.
- Copy or download. The file is saved with the right extension for the format.
Questions
Why does XML to JSON not have one correct answer?
Because XML expresses things JSON cannot. An element has attributes, child elements and text, all at once; JSON has only keys and values. Every converter therefore invents a convention — this one prefixes attributes with @ and puts an element’s own text under #text, both of which you can change. A second issue has no clean fix at all: a list of one item looks identical to a single element, so <a><b/></a> converts to an object where <a><b/><b/></a> converts to an array.
Is it safe to paste XML from an untrusted source?
Here, yes. The classic XML attacks work through external entities — a DOCTYPE that pulls in a local file or a remote URL, or one that expands exponentially to exhaust memory. The parser used here refuses entity declarations outright rather than resolving them, so neither is reachable. There is an automated test asserting exactly that, so a future dependency update cannot quietly weaken it.
What about unsafe YAML?
YAML’s reputation comes from parsers that instantiate arbitrary types from tags like !!python/object/apply. This parser uses the core schema: those tags resolve to ordinary strings and arrays, and nothing is constructed or executed. That behaviour is also covered by a test.
What is lost in conversion?
YAML comments and anchors disappear, because neither JSON nor XML can represent them. XML namespaces can be kept or stripped, but once in JSON they are just part of the key name. Numbers and booleans are normalised, so a quoted "true" in YAML and an unquoted true are not the same value. Round-tripping through a third format is where these differences show up, and it is worth checking rather than assuming.
Is my data uploaded?
No. Parsing and serialising both run in this page, which is the point — configuration files and API payloads routinely contain credentials and internal hostnames that have no business being pasted into someone else’s server.