DOCTYPE and DTD constructs are a common vector for entity expansion attacks, so they are blocked.

Can I paste XML instead of uploading?

Yes. Paste mode uses the same security checks and mapping rules.

Is processing private?

Yes. Conversion runs locally in your browser and files are not uploaded to Looty Tools servers for this workflow.

Inputs must be 25 MB or smaller unless a tool-specific limit says otherwise.

Yes. After a successful conversion you can copy the output text or download the file.

File & Data

This guide explains how XML to JSON keeps documents on-device and which safety rules still apply.

Ready to try the tool this guide describes?

The shared XML security module decodes UTF-8, rejects DOCTYPE, and parses with DOMParser in the browser.

External entities, non-UTF-8 encodings, and documents deeper than 50 levels are refused.

Why reject DOCTYPE?: DOCTYPE and DTD constructs are a common vector for entity expansion attacks, so they are blocked.
Can I paste XML instead of uploading?: Yes. Paste mode uses the same security checks and mapping rules.
Is processing private?: Yes. Conversion runs locally in your browser and files are not uploaded to Looty Tools servers for this workflow.
What file size limit applies?: Inputs must be 25 MB or smaller unless a tool-specific limit says otherwise.
Can I copy the result?: Yes. After a successful conversion you can copy the output text or download the file.

Jump into XML to JSON when you are ready to process your files.