Nothing is uploaded. When you paste text or open a file the converter reads it locally with the browser’s File API, parses it into a document tree with the native DOMParser, and serialises the JSON on your device in JavaScript. There is no server, API, database or tracking in the processing path, so a SOAP response, config file, RSS feed or any other sensitive data stays on your machine. The tool works offline once cached, and closing the tab discards everything. The one case where data touches the network is if you paste a remote URL for the tool to fetch — and even then the response is downloaded straight into your browser and never sent anywhere else. The only optional network use anywhere on the site is consent-gated advertising, which never sees your file.

The converter uses simple, well-known conventions. Every attribute becomes a key on the element’s object marked with the chosen prefix — @ by default, switchable to _ or $ — so <book id=“7”> yields {“book”: {“@id”: “7”}}. When an element carries both attributes (or child elements) and its own text, that text is stored under the reserved #text key so nothing is lost; a plain leaf element with only text becomes a simple string, and an empty leaf becomes null. Crucially, when several sibling elements share a tag name they are grouped into a JSON array, so a list of <item> elements becomes an array while a single <item> stays an object. CDATA can be preserved under a #cdata key and XML comments can be kept under #comment, or both can be dropped.

By default every value is emitted as a string, because XML is text between tags and has no type system. Turn on the “Infer types” option and the converter coerces obvious scalars: “true” and “false” become booleans, “null” becomes null, and numeric text becomes a number. The inference is deliberately conservative and round-trip safe — a value is only treated as a number when converting it back to a string reproduces the original exactly — so identifiers, phone numbers and codes with leading zeros such as “007” are left as strings rather than silently mangled into 7. You can also strip namespace prefixes so ns:foo becomes foo, which keeps keys clean when you do not need the namespace.

The tool is fully bidirectional. A Swap button and the XML → JSON / JSON → XML tabs flip it into a JSON to XML converter that applies the same conventions in reverse — @-prefixed keys become attributes, #text supplies element text, arrays repeat the parent tag — and uploads or fetched URLs auto-detect the direction from the first character. The honest limits follow from the models themselves: XML namespaces have no native JSON equivalent, so they are preserved as prefixed keys or xmlns attributes rather than as a formal namespace; mixed content and CDATA can round-trip imperfectly; and because everything is text, type inference is optional and conservative. Inputs are held in browser memory under a 25 MB cap, and loading a remote URL only works when that server sends permissive CORS headers.