XML to Base64

XML to Base64 encoding

Putting XML inside another document is awkward: angle brackets clash with HTML and XML, quotes clash with JSON, and whitespace may be altered along the way. Converting XML to Base64 wraps the whole document in a single, safe string. This tool encodes your XML as UTF-8 and outputs standard or URL-safe Base64.

Example

Input:

<?xml version="1.0"?>
<note>
  <to>Tove</to>
  <body>Don't forget me!</body>
</note>

Output:

PD94bWwgdmVyc2lvbj0iMS4wIj8+Cjxub3RlPgogIDx0bz5Ub3ZlPC90bz4KICA8Ym9keT5Eb24ndCBmb3JnZXQgbWUhPC9ib2R5Pgo8L25vdGU+

Documents that start with an XML declaration always encode to PD94bWwg — the Base64 form of <?xml — which makes Base64 XML easy to recognise.

Where Base64 XML is used

• SAML single sign-on. With the HTTP-POST binding, the SAMLResponse and SAMLRequest form fields contain Base64-encoded XML. (The redirect binding additionally DEFLATE-compresses the XML before encoding.)
• Embedding XML in JSON APIs, for example e-invoicing documents or signed receipts sent through a REST gateway.
• XML inside XML. Instead of escaping every < or using CDATA, some formats carry a nested document as Base64 text.
• Message queues and headers that only accept single-line ASCII values.

Keep the bytes identical

If the XML is digitally signed (XML-DSig, as in SAML assertions), even a changed space breaks the signature. Base64 preserves every byte exactly, which is one reason it is used for signed documents. For the same reason, avoid reformatting a signed document before encoding it. For unsigned XML, you may want to tidy it first with the XML Formatter or shrink it with XML Minify.

Encoding XML in code

Java: Base64.getEncoder().encodeToString(xml.getBytes(StandardCharsets.UTF_8)). C#: Convert.ToBase64String(Encoding.UTF8.GetBytes(xml)). Python: base64.b64encode(xml.encode('utf-8')). If you encode an uploaded file that was saved with a UTF-8 byte order mark, the Base64 starts with 77u/ instead of PD94 — some strict parsers reject the BOM, so check for it when a receiver complains about content before the XML declaration.

Encoding details

• The text is encoded as UTF-8. If your XML declares another encoding (such as ISO-8859-1), update the declaration or the receiver may misread non-ASCII characters.
• Choose URL-safe output when the value goes into a URL or cookie; standard Base64 with + and / is expected by SAML POST forms and most APIs.
• You can also upload an .xml file instead of pasting it.

Decode Base64 XML with Base64 to XML. The encoding runs in your browser, so internal documents are not uploaded.

One line or wrapped lines?

This tool writes the Base64 as a single line, which is what SAML forms, JSON fields and HTTP headers expect. Command-line encoders often wrap the output instead: GNU base64 inserts a line break every 76 characters and openssl base64 every 64. Those breaks are harmless in email attachments but can make a receiver reject the value elsewhere. Use base64 -w 0 file.xml or openssl base64 -A -in file.xml to get one line, or remove the line breaks before pasting the value into a request.