Converting an XML file to CSV means flattening a structured document into a rectangular table where each row represents one record and each column represents one attribute or child value, all in plain comma-separated text. The XML to CSV Converter does this in your browser: you paste a well-formed XML document, name the exact qualified tag that repeats as your record element, and the converter walks every matching element to build a deterministic column union that follows the RFC 4180 profile for CSV output. Parsing and serialization happen locally, so the source document is never uploaded, and you can copy the result to the clipboard or download it as a UTF-8 text/csv file without a byte-order mark. This approach suits predictable XML feeds such as catalogs, RSS-style exports, or REST payloads whose repeating elements share a small set of scalar children, but it does not infer records automatically, so choosing the right record name is the single decision that drives every column.
What the Converter Builds From Your XML
The converter treats every element whose tag exactly matches the qualified name you supply as one record. If you type item, only <item> elements become rows; a <product> element or <item> namespaced as ns:item would not be matched, because matching is case-sensitive and must include any prefix exactly as written through getElementsByTagName.
Within each matched record, the converter distinguishes three kinds of data source: attributes on the record element, direct child elements, and any direct text that is not purely whitespace. Attributes become columns whose name begins with @, so a record like <item id="42" sku="A1"> produces columns @id and @sku. A direct child like <name>Widget</name> produces a column named name containing the trimmed text Widget. A direct child that repeats, for example three <tag> elements inside one <item>, is preserved as a compact JSON array in one CSV cell, so nothing is silently dropped when the same child name appears more than once.
Nested markup is flattened to descendant text. If a record has <description>Light <b>blue</b> cotton</description>, the description column receives the string Light blue cotton with no preserved markup boundary, child attribute, comment, processing instruction, or mixed-content ordering. This is an intentional design choice: the converter produces a rectangular table, not a faithful XML round-trip.
How to Convert an XML File to CSV in the Browser
- Open the XML to CSV Converter in your browser and paste a well-formed XML document into the input area. The browser parses it as application/xml with a DOM parser, and a malformed document returns an error document that blocks conversion.
- Enter the exact qualified name of the repeating record element, such as item, product, or ns:item. The converter matches case-sensitively with the prefix you supply, so a typo or wrong prefix means zero rows are produced.
- Decide whether to keep spreadsheet formula protection enabled. The option is on by default and prefixes values that begin with =, +, -, or @ with a tab inside a quoted field, following the Excel-oriented mitigation discussed by OWASP. Leave it on for any CSV that a human will open in Excel or Google Sheets; turn it off only when the destination treats every cell as inert text and you need exact raw values.
- Click Convert. The converter walks every matching element, builds the deterministic column union from the first record forward, flattens each row, and serializes the result.
- Verify the record count and column count displayed by the tool against your source. A simple sanity check is to compare the number of opening record tags in the XML with the row count in the CSV minus one for the header row.
- Copy the CSV to the clipboard or download it as a UTF-8 text/csv file. Open it in your spreadsheet, and inspect any cell that is a JSON array to confirm repeated children survived.
How Columns Map to Attributes, Children, and Repeats
| Source in the XML record | CSV column name | Cell value |
|---|---|---|
| <item id="42"> attribute | @id | 42 |
| <name>Widget</name> direct child | name | Widget |
| Repeated direct child, e.g. three <tag> elements | tag | ["a","b","c"] compact JSON array |
| <item>note<name>X</name></item> direct non-whitespace text | #text | note |
| Element present in a later record only | Appended after current columns | Empty in earlier rows |
| Nested markup like <desc>A <b>B</b> C</desc> | desc | A B C flattened text |
The column order is deterministic: fields that appear on the first record are emitted first, and any previously unseen field from a later record is appended in the order it is first encountered. If record 1 has columns @id, name, and price, and record 7 introduces stock, every row in the output gains a stock column at the end, and records 1 through 6 leave it empty. This predictable ordering matters for diffs across exports and for importers that assume a stable header.
Formula Protection and Spreadsheet-Safe Output
CSV output follows the RFC 4180 profile: columns are comma-separated, records use CRLF line endings, and any field that contains a comma, double quote, tab, carriage return, or line feed is enclosed in double quotes with internal quotes doubled. Spaces inside values are preserved. The first record is a header row built from the deterministic column union, and missing columns become empty fields rather than skipped separators.
Spreadsheet programs may interpret a cell that begins with =, +, -, or @ as a formula, which is a well-known CSV injection vector. With formula protection enabled, which is the default, the converter prefixes those values with a single tab inside the quoted field, neutralizes the formula interpretation in Excel, and preserves the original characters in the underlying text. Disable the option only when you are feeding the CSV into a tool that reads every cell as inert text and you need the exact raw string. The mitigation follows the Excel-oriented guidance from OWASP and is not a universal guarantee against every spreadsheet or programmatic importer.
The downloaded file is plain UTF-8 text/csv with no byte-order mark. Some legacy spreadsheet configurations need an import wizard or an explicit UTF-8 selection; date, number, leading-zero, identifier, and Boolean spellings from XML remain text in the CSV, so any spreadsheet may still guess types when opening the file. Import with controlled column types when leading zeros or numeric precision must survive.
Limits, Errors, and Conversions It Will Not Perform
The converter enforces hard limits and fails rather than truncating. Inputs are capped at 500,000 XML characters, 10,000 matching records, 200 columns, and 5,000,000 CSV characters. A document that exceeds any limit returns an error rather than a partial CSV, which keeps silent data loss out of production exports.
Parsing rules are strict. The browser must accept the input as application/xml; malformed tags, unescaped quotes, and broken entities return an error document and block conversion. DOCTYPE declarations are rejected before parsing, so the tool does not process external entities, DTD defaults, or custom entity definitions, which is a deliberate security boundary. Namespaces are matched literally through the qualified name you type, not normalized.
XML has no universal record-to-table mapping, so the converter makes specific choices rather than trying to infer them. It will not detect records automatically, expand nested arrays into multiple rows, join parent values into child rows, evaluate XPath, normalize namespaces, preserve schema types, validate against an XSD, or convert arbitrary mixed-content documents without loss. If your source does not look like a list of repeated elements with scalar children, such as a catalog of <item> nodes, a feed of <entry> nodes, or a list of <order> nodes, reach for an explicit XSLT stylesheet or application code instead.
Verifying Your CSV Against the Source
The fastest way to catch a conversion error before it propagates is a side-by-side check. Count the number of opening tags for your chosen record element in the source XML and confirm it matches the data row count in the CSV, with the header row excluded. Compare the number of distinct attribute names plus distinct direct-child names across the first record against the header row, and confirm that any field you expected is present in the order you expected.
Open the CSV in a spreadsheet, scroll to a record you know well, and inspect its cells. A cell that begins with [ signals a JSON array of repeated children; expand it to verify the full set is intact rather than silently collapsed to one value. A cell that begins with a tab character signals formula protection kicked in, which is expected and safe to keep for human-facing exports.
For larger inputs, sample several records from different positions in the file. Records near the start establish the column order, records in the middle often introduce new fields, and records near the end stress the deterministic column union. If a column you needed is missing from the header, the record name may not have matched every occurrence, so re-check the qualified name for typos or prefix mismatches before replacing a production export.
If you're weighing options, Convert XML to JSON for OIC: A Local Browser Workflow covers this in detail.
If you're weighing options, Convert CSV to HTML Table in JavaScript: A Safe Workflow covers this in detail.