SVG Validator. Check & Lint SVG Online for Errors and Security
Paste or drop an SVG and get an instant pass/fail checklist: is it well-formed XML, does it declare xmlns and a viewBox, are its dimensions sane, and does it hide a <script>, an onload handler or a <foreignObject> that would make it a stored-XSS risk? A live preview and composition report sit right beside the findings, all in your browser, never uploaded.
What is the svg validator?
The SVG Validator checks a pasted SVG for well-formed XML, xmlns and viewBox declarations and sane dimensions, then flags <script>, on* handlers, <foreignObject> and javascript: XSS vectors. A pass/fail checklist sits beside a live preview and composition report. Free, in-browser, never uploaded.
The GigAI SVG Validator is a correctness-and-safety linter for SVG markup that runs entirely in your browser. When an SVG silently fails to render, refuses to scale, or gets rejected by a CMS or a security review, the cause is almost always one of a handful of specific problems, and this tool checks for each of them explicitly instead of leaving you to guess. It first parses your markup with the browser's native XML engine to prove the document is well-formed, surfacing the exact parser error (unclosed tag, stray ampersand, mismatched quote) when it isn't. Then it runs a structured checklist: is there a real <svg> root, is xmlns declared so the file works as a standalone asset, is a viewBox present so the graphic scales responsively, and are the width/height values sane rather than zero, negative or wildly out of range? Alongside correctness it runs a security pass for the vectors that make SVG a genuine stored-XSS risk when rendered inline, embedded <script> elements, inline event handlers like onload and onclick, <foreignObject> that can smuggle arbitrary HTML, javascript: URLs, and external URL references that can leak requests or break offline. Every finding is shown as a clear pass, warning or error with a one-line explanation of why it matters and what to do, so a junior developer and a security reviewer read the same report the same way. A live checkerboard preview renders the SVG beside the findings so you can see the artwork while you read the verdict, and a composition report breaks down elements, colors, gradients, filters and animation. Because it is 100% client-side, unreleased logos, customer-supplied uploads and internal icons never leave your machine. Note that this is an advisory linter, not a sanitizer. It tells you an SVG is dangerous to embed. It does not rewrite it to make it safe.
- Difficulty:
- Easy
- Typical time:
- ~10s
- Processing:
- 100% browser processing
Last updated
How to use the svg validator
- 1
Add your SVG
Paste markup into the editor, drop a.svg file onto the workspace, or click Open. Load a sample, including a deliberately broken and a deliberately unsafe one, to see the report in action.
- 2
Read the checklist
Scan the pass/warning/error rows: well-formedness, <svg> root, xmlns, viewBox, dimensions, and the security scan. Each row explains what it means and why it matters.
- 3
Confirm against the preview
Glance at the live checkerboard preview to confirm a valid SVG actually renders the way you expect, and check the composition report for gradients, filters or animation.
- 4
Fix and re-validate
Edit the source in place and watch the checklist update live, or copy the markup into the Optimizer once it's clean. Share a link to reopen the tool with your SVG pre-loaded.
What SVG Validator includes
Real XML well-formedness check
Parses your SVG with the browser's own DOMParser and reports the exact syntax error (an unclosed tag, a bare ampersand, a mismatched quote) instead of a vague 'invalid file'.
Structured pass/fail checklist
Every check (<svg> root, xmlns, viewBox, dimension sanity) is a distinct row with a pass, warning or error state and a one-line reason, so the verdict is unambiguous at a glance.
Security / XSS scan
Flags the vectors that make inline SVG dangerous: <script>, inline on* handlers, <foreignObject>, javascript: URLs and external references: the exact things a security review will catch.
viewBox & scaling diagnosis
Tells you whether a viewBox is present and warns when it is missing, because that single attribute is why an SVG scales to its container, or renders at one fixed, wrong size.
Live preview beside the report
The SVG renders on a transparency checkerboard next to the findings, so you can see the artwork while you read the verdict and confirm a 'valid' file actually looks right.
Composition breakdown
Beyond pass/fail, it reports element counts, distinct colors, and whether the SVG uses gradients, filters or animation, useful context when you're deciding whether to trust or ship it.
Why use our svg validator
Stop guessing why an SVG won't render
Instead of staring at markup that produces a blank box, get the specific parser error or the missing attribute named, with the fix stated in plain language.
Catch XSS before it ships
Screen customer-supplied or third-party SVGs for the script, handler and foreignObject vectors that turn an innocent-looking icon into stored XSS when you inline it.
Fix responsive scaling at the source
A missing viewBox is the number-one reason an SVG won't scale. The validator names it explicitly so you add the one attribute that fixes fluid sizing everywhere.
Nothing leaves your browser
Validate unreleased logos, internal icons and untrusted user uploads without sending a single byte to a server. The whole linter runs on your device.
Built for the way you work
From quick one-off fixes to daily workflows, see how people put this tool to use.
- Frontend developer
Debug a blank-box SVG
An inlined SVG renders as an empty box. Paste it and the validator names the culprit, a missing viewBox, an absent xmlns, or a well-formedness error the browser swallowed silently.
- Security engineer
Screen user-uploaded SVGs
Before allowing SVG uploads to render inline, run samples through the security scan to see exactly which files carry <script>, on* handlers or <foreignObject> and must be sanitized.
- Design systems engineer
Gate icons before the registry
Validate every icon for a clean <svg> root, a viewBox and sane dimensions so your sprite or icon library stays consistent and nothing lands broken in the design system.
- CMS / Platform team
Explain a rejected upload
When a CMS rejects an SVG, the validator's specific error and security findings tell you whether it's a syntax problem or an unsafe construct, and what the author needs to change.
Supported formats
Accepts SVG, and produces SVG, all processed locally in your browser.
- SVG
- SVG
Frequently asked questions
Recommended tools
SVG Viewer
Open, paste or drop an SVG to view it on a checkerboard, light or dark canvas with zoom, live dimensions, a source-code pane and a full element/color report: 100% in your browser, nothing uploaded.
SVG Optimizer
Minify and clean SVG files in your browser with SVGO, strip editor metadata, round coordinates, drop hidden layers and see the exact bytes and percentage saved. Nothing is uploaded.
SVG to React
Convert SVG to a clean React component in your browser, camelCased attributes, TypeScript or JS, memo, forwardRef and React Native output, with a live preview. Nothing is uploaded.
Image Compressor
Shrink JPG, PNG and WebP images without a visible quality drop. Set the quality yourself, or compress to an exact target size like 100 KB. Free, entirely in your browser.
JSON Formatter
Format, validate and minify JSON in your browser with pinpoint error line + column, jump-to-error, key sorting and live editing: nothing is uploaded.
Data URI to SVG
Decode a data:image/svg+xml URI back into raw SVG in your browser, handles base64 and URL-encoded payloads, with a live preview and one-click.svg download. Nothing is uploaded.
Common problems, solved
Hit a snag? Here are quick fixes for the issues people run into most.
It says my SVG is not well-formed but it opens fine in my browser.
Browsers are lenient and auto-repair some markup on display. A strict XML parse is stricter. The validator reports the exact error (an unescaped &, an unclosed tag, a stray quote). Fix that character and re-validate. The file will be portable to tools that aren't so forgiving.
The security scan flagged my own trusted SVG.
The scan is intentionally conservative: it flags any <script>, on* handler, <foreignObject> or external reference regardless of intent, because those are real vectors when a file is embedded inline. If you authored and trust the file the warning is informational, but strip those constructs before rendering any SVG you didn't create.
It warns about a missing viewBox even though width/height are set.
width and height set a fixed pixel box. The viewBox is what defines the internal coordinate system and lets the SVG scale to its container. Add a viewBox that matches your artwork's coordinate space (e.g. viewBox="0 0 24 24") to fix responsive scaling.
The validator passes but the preview is blank.
A file can be well-formed and still draw nothing, shapes painted with fill="none" and no stroke, elements positioned outside the viewBox, or zero width/height. Check the composition report for element counts and use the Viewer or Optimizer preview to inspect it more closely.
Get the most out of it
Treat any warning in the security scan as blocking for SVGs you didn't author yourself: the scan flags the vector, but you decide the trust.
A missing viewBox is the single most common cause of an SVG that won't scale. Add one before you debug anything else.
Remember this is an advisory linter, not a sanitizer. It tells you a file is unsafe to embed but does not rewrite it. Use a dedicated sanitizer for that.
Once an SVG validates clean, send it straight to the Optimizer to shrink it before you inline or ship it.
If well-formedness fails, fix the first reported error and re-validate, a single unescaped ampersand often cascades into several confusing parser messages.
What's new
Recent updates and improvements to the svg validator.
Initial release, client-side well-formedness check, structured pass/fail checklist (svg root, xmlns, viewBox, dimensions), security/XSS scan, live checkerboard preview, composition report, copy, download, undo/redo and shareable links.
Added deliberately broken and deliberately unsafe sample SVGs, per-finding explanations, and clearer guidance that the tool is an advisory linter and not a sanitizer.
Refined the security scan to separately surface external-URL references as info, tightened dimension-sanity thresholds, and added keyboard shortcuts.
Keep exploring
Problems we solve
From the blog
- HTTP Security Headers Explained: CSP, HSTS, and the Rest
- How to Reduce SVG File Size: Minify, Trim Precision, and Strip the Cruft
- Every AI Crawler User-Agent, and Whether to Allow It
- Cloudflare Blocks AI Crawlers by Default: How to Check and Fix It
- Why AI Crawlers Don't Run JavaScript, and What That Costs You
Explore categories
Compare formats
Common tasks
Your privacy is built in
Your SVG is parsed and linted entirely in your browser. It is never uploaded to any server. Nothing is stored, logged or transmitted, so you can safely validate unreleased brand marks, internal icons and untrusted user uploads. Note that the validator is an advisory linter that identifies risky constructs. It does not sanitize or rewrite your SVG. Close the tab and every trace is gone.
- Runs in your browser
- No uploads
- Nothing stored
Ready to try the svg validator?
Free, private and instant. SVG Validator runs right in your browser.