XML Schema Validator
Validate XML against a supplied XSD 1.0 Core schema with namespace-aware findings and blocked external resource resolution in your browser.{{ summaryTitle }}
{{ summaryLine }}
Validation review
{{ section.title }}
{{ section.body }}
{{ reviewCopyAnnouncement }}
The chart renderer is unavailable. The same counts remain available in the review and finding ledger.
| Source and path | Rule | Severity | Finding | Next action | Copy |
|---|---|---|---|---|---|
| {{ finding.source }} · {{ finding.source_position }}{{ finding.path }} | {{ finding.rule }}{{ finding.constraint }} | {{ finding.severity }} | {{ finding.message }} | {{ finding.action }} | |
| No findings in the selected view.This bounded XSD 1.0 Core result is not a claim of complete XSD 1.0 or XSD 1.1 processor conformance. | |||||
The report reached the 200-finding limit. Fix the shown findings, then validate the updated source.
Well-formed XML follows the basic syntax of matching tags, quoted attributes, and one document element. Schema validity asks a narrower business question: does that XML also match the elements, attributes, datatypes, namespaces, and content order declared by an XML Schema Definition (XSD)? A document can be well formed and still fail its schema.
Namespaces are part of an element’s identity. <order xmlns="urn:sales"> and <order xmlns="urn:archive"> have the same local name but represent different expanded names. Many apparent “element not declared” errors are namespace mismatches rather than spelling mistakes.
- Instance document
- The XML data being checked.
- Primary schema
- The XSD that declares the expected document root and its main namespace.
- Content model
- The allowed child elements, order, alternatives, and occurrence counts.
- Facet
- A restriction on a simple value, such as an enumeration, length, or inclusive or exclusive numeric bound.
Full XSD processors can resolve imported schemas and support a large language of type derivation, wildcards, identity constraints, regular-expression facets, and newer XSD 1.1 features. A bounded local validator should say when a construct is outside its profile instead of silently treating unexamined content as conforming.
How to Use This Tool:
Supply the instance and its primary schema together, then add only the in-memory schemas that an explicit include or import needs.
- Paste or load one XML document up to 200,000 characters.
- Paste or load the Primary XSD. Its root must be an XSD
schemaelement, and the expected document root must be declared globally. - When the primary XSD uses
includeorimport, open Advanced and add each dependency as a named in-memory schema block. The block key must exactly match its safe relativeschemaLocation. - Read the verdict before filtering findings. Unsupported or security findings mean the validator could not make a complete conformance claim under its XSD 1.0 Core profile.
- Follow each finding’s source, line, column, XML path, rule, and next action. Correct schema errors before instance errors because an invalid or unsupported schema blocks document validation.
- Validate again after every schema or XML change. The Finding view filters only the visible ledger; it does not change the verdict, counts, or exported full report.
Interpreting Results:
- Conforms means the XML is well formed and no finding was produced within the supported XSD 1.0 Core profile.
- Does not conform means a supported schema or instance rule failed, such as a wrong namespace, missing required child, invalid datatype, or undeclared attribute.
- Unsupported means at least one schema feature or security-sensitive construct prevented a complete validation. It must not be read as either valid or invalid under a full XSD processor.
Technical Details:
Validation begins with secure, namespace-aware XML parsing. The schema set is checked and compiled before the instance is examined. This order prevents an invalid or partly unsupported schema from producing false confidence about the document.
Mechanism Core
- Reject document type declarations, entity declarations, parameter-entity substitution, XInclude, unsafe schema locations, and malformed XML before resource resolution.
- Parse the primary XSD and as many as seven additional in-memory schemas, checking target namespaces and exact include/import relationships.
- Report unsupported XSD constructs explicitly, then compile supported global elements, simple types, complex types, attributes, and content particles.
- Match the instance root by expanded name: namespace plus local name.
- Validate element and attribute declarations, required or prohibited attributes, fixed values, simple datatypes and facets, child order, choices, all-groups, and occurrence counts.
- Return a conformance verdict only when no error, unsupported, or security finding remains.
| Supported core | Reported as unsupported |
|---|---|
| Global and local elements, inline and named simple or complex types, and local attributes. | Attribute groups, named model groups, wildcards, referenced global attributes, and recursive types or elements. |
sequence, choice, all, and bounded minOccurs/maxOccurs. | Occurrence counts above 5,000, mixed content, substitution groups, abstract or nillable elements. |
| Simple restrictions using enumeration, length, whitespace, and inclusive or exclusive bounds. | Pattern, list, and union simple types; identity constraints such as key, keyref, and unique. |
| Selected XSD 1.0 built-in string, numeric, date, URI, and binary datatypes. | XSD 1.1 assertions, type alternatives, open content, override, and unsupported built-in datatypes. |
| In-memory include and import through safe relative keys. | Network URLs, file paths, absolute paths, parent traversal, and unresolved schema locations. |
Inclusive facets accept a value equal to the boundary; exclusive facets require the value to be strictly above or below it. Integer subtypes enforce their XSD ranges, dates use the supported lexical calendar form, and element-only complex content rejects non-whitespace text.
Security and Limits:
The XML and XSD sources remain inert text in the browser. External resource access is disabled: the validator does not follow network URLs, local file paths, external entities, XInclude, or schema locations that are not matched to supplied in-memory schema blocks.
| Resource | Limit |
|---|---|
| XML document | 200,000 characters |
| Primary XSD | 200,000 characters |
| Additional schema bundle | 300,000 characters |
| Schema documents | 8 total |
| Nodes per document and maximum depth | 5,000 nodes and 64 levels |
| Finding ledger | 200 findings |
References:
- XML Schema Part 1: Structures Second Edition, W3C, 28 October 2004.
- XML Schema Part 2: Datatypes Second Edition, W3C, 28 October 2004.
- XML External Entity Prevention Cheat Sheet, OWASP Foundation.