XML Security Scan
Detect external entities, DOCTYPE risks and entity-expansion patterns; optionally strip them.
All processing on this page runs locally in your browser unless noted otherwise.
Ctrl/⌘ + Enter to run
Heuristic scanner for debugging — not a substitute for AppSec review.
Input
Sanitized output
How to use
- Paste XML that may contain DOCTYPE or ENTITY declarations.
- Scan to classify risk; sanitize to strip dangerous constructs.
- Use the sanitized copy with safer parsers.
FAQ
Does this resolve external entities?
No. It never fetches external resources; it only pattern-matches.
Is scanning local?
Yes.