Prompt Formatter AI & Writing
Wrap prompt sections in XML-style tags, the structure models follow most reliably.
Prompt Formatter is a free online tool that wrap prompt sections in XML-style tags, the structure models follow most reliably. It runs entirely in your web browser using plain JavaScript, so files are processed on your own device and never uploaded to a server. There is no sign-up, no file size limit imposed by the site, no watermark and no paid tier.
- Price
- Free — no account, no quota, no watermark
- Category
- AI & Writing
- Where it runs
- In your browser, on your device
- Files uploaded
- None
- Technology
- plain JavaScript
- Settings
- 3
- Works offline
- Yes, after the first visit
About Prompt Formatter
Delimiting the sections of a prompt with XML-style tags is the highest-value formatting change available, and it costs nothing. A model that can see exactly where the instructions end and the pasted data begins is markedly less likely to follow instructions that appear inside that data — which makes this the cheapest prompt-injection mitigation there is, not just a readability choice.
How to use it
- Paste the text you want to run through prompt formatter.
- Set delimiter style, section names, one per line and add an injection guard line.
The 3 settings
| Setting | What it does | Default |
|---|---|---|
| Delimiter style | Choose from 3: XML tags — <instructions>, Markdown headings — ## Instructions, Hash fences — ### INSTRUCTIONS ###. | XML tags — <instructions> |
| Section names, one per line | Free text. | role
instructions
data |
| Add an injection guard line | On or off. On by default. | On |
Under the hood
| Runs on | plain JavaScript — runs the whole thing |
| Controls | Delimiter style, Section names, one per line, Add an injection guard line |
Questions
Why XML tags rather than markdown headings?
Tags have an unambiguous open and close, so a section boundary cannot be faked by content that happens to contain a heading. Markdown headings work fine when the input is trusted; the tag form is what you want when any part of the prompt comes from a user.
Does the injection guard actually work?
It helps and it is not a guarantee. Telling a model that a section is data rather than instructions measurably reduces successful injections, but no prompt-level instruction is a security boundary. Anything that matters still needs authorization checked outside the model.
How do I split my prompt into sections?
Separate the parts with a blank line. The first block maps to the first section name, the second to the second, and so on. Anything left over is appended to the last section rather than dropped.