XML
Extensible Markup Language: a verbose, tag-based format for structured data. Still used in enterprise systems, SOAP, and configuration files.
What is XML?
In short
XML (Extensible Markup Language) is a text format that stores structured data using nested tags you define yourself, such as <order><item>Book</item></order>. It is both human-readable and machine-parseable, which is why it powered SOAP web services, RSS feeds, and countless config files before JSON became the default for web APIs.
What XML actually is
XML is a markup language for describing data, not for displaying it. You wrap each piece of information in a tag that you name, and tags can nest inside other tags to form a tree. A purchase order, a book catalog, or an application config can all be expressed as the same kind of labeled tree.
Unlike HTML, XML has no built-in tags. There is no <p> or <table> that means anything special. You invent the vocabulary: <invoice>, <customer>, <line-item>. That is what the X (extensible) stands for. The format only enforces the rules of well-formedness, such as every opening tag having a closing tag and tags nesting properly without overlapping.
Every XML document has one root element that contains everything else. Elements can carry attributes (id="42"), hold text content, or hold child elements. A document that follows the syntax rules is well-formed. A document that also matches a declared structure (via a schema) is valid.
How it works under the hood
A parser reads the raw text and turns it into a tree your program can walk. There are two common parsing styles. DOM parsers load the entire document into memory as a tree, which is convenient but uses memory proportional to file size, so a 2 GB XML file becomes a problem. SAX and StAX parsers stream the document and fire events as they hit each tag, which keeps memory flat and is how you process huge files.
Structure can be enforced with a schema. The two main options are DTD (the old, limited one) and XML Schema Definition (XSD), which supports data types, cardinality, and namespaces. A validating parser rejects any document that breaks the schema before your code ever sees bad data.
To pull values out, you use XPath, a query language that addresses nodes by path, like /invoice/line-item/price. To transform one XML shape into another, or into HTML, you use XSLT. Namespaces (xmlns) let two vocabularies that both define a <title> element coexist in the same document without colliding.
When to use it and the trade-offs
XML earns its keep where strict structure, validation, and rich tooling matter more than compactness. Document-heavy formats lean on it: DOCX and XLSX files are zipped XML, SVG is XML, and SAML assertions for enterprise single sign-on are XML. If you need schema validation, namespaces, mixed content (text interleaved with tags), or attributes versus elements, XML gives you all of it natively.
The cost is verbosity and complexity. Every value is wrapped in an open and close tag, so XML payloads are typically larger than the equivalent JSON, often by 30 percent or more. Parsing is heavier, and the surrounding stack (XSD, XSLT, XPath, SOAP envelopes) has a real learning curve. XML parsers have also been a classic security target through the XXE (XML External Entity) attack, so external entity resolution should be disabled.
For most web and mobile APIs built after roughly 2015, JSON won because it is lighter, maps directly onto JavaScript objects, and needs no extra tooling. Reach for XML when you are integrating with SOAP services, parsing office documents, working with SVG, or talking to enterprise and government systems that standardized on it years ago.
A concrete example
Here is a small, well-formed document. The root is <order>, it carries an attribute, and it holds two nested elements:
<order id="1042"><customer>Acme Corp</customer><total currency="USD">59.90</total></order>
A SOAP request wraps this kind of payload inside an <Envelope> and <Body>, adds namespaces, and ships it over HTTP. The receiving service validates it against an XSD, and if the total is missing or non-numeric the request is rejected before any business logic runs. That up-front contract enforcement is exactly why banks, airlines, and telecom billing systems still run on XML decades after they were built.
Where it is used in production
Microsoft Office (Open XML)
DOCX, XLSX, and PPTX files are ZIP archives of XML parts, which is why a Word document can be opened and edited programmatically.
SOAP web services
Enterprise and banking APIs use SOAP, which carries every request and response as an XML envelope validated against a WSDL and XSD contract.
SAML single sign-on
Identity providers like Okta and Microsoft Entra ID issue authentication assertions as signed XML documents for enterprise SSO.
RSS and Atom feeds
Podcast and news feeds publish updates as XML, which is how Apple Podcasts and feed readers discover new episodes.
Frequently asked questions
- What is the difference between XML and HTML?
- HTML has a fixed set of tags meant to display content in a browser. XML has no predefined tags; you invent your own to describe data, and it says nothing about how that data looks. HTML is for presentation, XML is for structured data exchange.
- Is XML still used in 2026, or is it dead?
- It is far from dead. JSON replaced it for most public web and mobile APIs, but XML still runs SOAP services, SAML logins, Office documents, SVG graphics, RSS feeds, and a huge amount of enterprise and government infrastructure that will not be rewritten any time soon.
- XML vs JSON: which should I choose?
- Choose JSON for typical web and mobile APIs where you want light payloads and easy parsing in JavaScript. Choose XML when you need schema validation, namespaces, mixed content, document formats, or you are integrating with a system that already speaks SOAP or SAML.
- What does well-formed versus valid mean in XML?
- Well-formed means the document follows XML syntax rules: one root element, every tag closed, proper nesting. Valid means it is well-formed and also conforms to a declared schema (DTD or XSD) that defines which elements, attributes, and data types are allowed.
- How do I read a specific value out of an XML document?
- Use XPath, a query language that addresses nodes by their path, such as /order/total. Most languages ship an XPath engine, so you can pull a single value without manually walking the whole tree.
Learn XML hands-on
This page explains the idea. The full lesson lets you step through the ring as servers join and leave, read the implementation, and check yourself with a quiz. It is one of 760+ lessons in the System Design Masterclass, from your first API call to distributed consensus. Eleven Foundation lessons are free, no signup. Lifetime access is ₹499 in India or $7.99 worldwide, one payment, no subscription.
Related lessons
Lessons that touch on XML as part of a larger topic.
SOAP
The enterprise protocol that dominated before REST. XML-based, strictly typed, and still running critical infrastructure
intermediate · api design protocols
SAML
Security Assertion Markup Language, the XML-based protocol that powers enterprise single sign-on and identity federation
intermediate · security architecture
XML Schema
Formal validation rules for XML document structure and data types
foundation · core fundamentals
See also
Related glossary terms you might want to look up next.
JSON
JavaScript Object Notation: a lightweight text format for data interchange using key-value pairs and arrays. The lingua franca of web APIs.
REST API
An architectural style for building APIs using standard HTTP methods (GET, POST, PUT, DELETE). Resources are identified by URLs.
HTTP
The protocol powering the web. A request-response model where clients ask for resources and servers respond. Stateless by design.
Latency
The time delay between sending a request and getting a response. Amazon found every 100ms of extra latency costs 1% in sales.
Throughput
The number of operations a system can handle per unit of time. Think of it as how many cars a highway can move per hour.
Bandwidth
The maximum amount of data that can be transferred over a network in a given time. It's the width of the pipe, not how fast the water flows.