XML URL Encode

How to use the XML URL Encode

Type or paste into the XML box, or click Sample. You can also drop a text file on either box, or load one into the URL encoded box with its Open file button.

The URL encoded box updates live as you type. It works both ways — edit the URL encoded side to convert back, or click ⇄ Swap to exchange the sides.

Use Copy or Download on either box to take the result, or Clear to start again.

XML URL encode for query strings and forms

Some protocols still send XML inside URLs or form fields. SAML SAMLRequest and RelayState parameters, legacy payment gateways, SOAP-over-GET bridges and older enterprise APIs are typical examples. The XML URL encode tool percent-encodes your markup with encodeURIComponent rules so every <, >, ", & and = is transported safely.

Example

Input:

<order id="7"><item qty="2">Tea &amp; biscuits</item></order>

Output:

%3Corder%20id%3D%227%22%3E%3Citem%20qty%3D%222%22%3ETea%20%26amp%3B%20biscuits%3C%2Fitem%3E%3C%2Forder%3E

Look at & in the input: it becomes %26amp%3B. The XML entity is preserved, and the receiving side gets back exactly the XML you encoded after one round of URL decoding.

Two layers of escaping

XML in a URL involves two independent escaping schemes, and it helps to keep them apart:

XML escaping protects characters that are special in XML, turning a literal ampersand in text into &. Do this first, when you build the XML — the XML Escape tool helps with individual values.
URL encoding protects the finished document while it travels inside a URL. That is what this tool does.

The receiver undoes them in reverse order: URL-decode, then parse the XML.

About SAML redirects

SAML’s HTTP-Redirect binding does not URL-encode the raw XML directly. It first compresses the XML with raw DEFLATE, then Base64-encodes it, and only then URL-encodes the Base64 string. If you are building or debugging such a request, a plain XML URL encoding will not be accepted by the identity provider. HTTP-POST bindings use Base64 without compression in a form field.

Encoding XML in code

Use encodeURIComponent(xml) in JavaScript and rawurlencode($xml) in PHP. In Python, remember that urllib.parse.quote leaves / unencoded by default; call quote(xml, safe='') so closing tags such as </item> are fully encoded. When you build a query string with a helper such as URLSearchParams or urlencode, the encoding is applied automatically and you should not encode the XML yourself first.

Tips

Remove the XML declaration and unnecessary whitespace to keep the URL short; every space costs three characters.
Prefer POST bodies for large documents. Many servers reject URLs longer than a few thousand characters.
To reverse the process, use XML URL Decode, which shows the decoded markup with XML highlighting.

Encoding happens in your browser, so your documents are not uploaded.

Frequently asked questions

Do I need to XML-escape before URL encoding?

Your XML must already be well-formed, which means values inside it are XML-escaped. URL encoding is a separate step that protects the finished document in the URL.

Is this how SAMLRequest parameters are encoded?

Not exactly. The SAML redirect binding deflates and Base64-encodes the XML before URL encoding it. This tool performs only the final URL-encoding step on plain XML.

Why are spaces encoded as %20 and not +?

The tool uses encodeURIComponent rules, which write spaces as %20. That is valid in every part of a URL and in form bodies.

How long can a URL with XML be?

There is no single limit, but many browsers, proxies and servers start rejecting URLs somewhere between 2,000 and 8,000 characters. Send larger XML in a POST body.

How do I decode the parameter on the server?

Most frameworks decode query and form parameters automatically, so you receive the plain XML. When decoding by hand, use decodeURIComponent in JavaScript or URLDecoder.decode(value, StandardCharsets.UTF_8) in Java; note that URLDecoder also turns + into a space.