XML Escape & Unescape
Safely escape special characters like <, >, &, ", and ' into XML entities, or unescape encoded entities back to standard XML markup.
📤 Share it with others.
XML escaping converts the five reserved characters <, >, &, ", and ' into their entity equivalents (<, >, &, ", ') so they are treated as literal text instead of markup. Unescaping reverses the process, turning entities back into normal characters. Use the tool above to convert either direction instantly in your browser.
About the XML Escape and Unescape Tool
XML has five characters with special meaning in its syntax: the less than sign, the greater than sign, the ampersand, the double quote, and the single quote (apostrophe). When any of these appear inside element content or attribute values without being escaped, an XML parser can misread them as the start of a tag or an entity, which breaks the document or introduces a parsing error.
This tool lets you paste plain XML (or text containing XML like characters) and convert it into safely escaped output, or paste escaped XML and convert it back to readable, original text. Everything runs directly in your browser using JavaScript, so nothing you paste is uploaded or stored anywhere.
How to Use the XML Escape and Unescape Tool
- Choose a mode: Escape XML or Unescape XML, using the toggle at the top.
- Paste your XML content into the Source Input box, or click Sample to load example data, or click Upload to bring in a .xml or .txt file.
- If you are escaping, decide whether also to escape quote characters and whether to encode non-ASCII characters as numeric references, using the checkboxes above the input.
- Click Execute Conversion, or leave Live Auto Convert turned on to see the result update as you type.
- Copy the result with one click, or download it as a file.
- Use Swap to flip the input and output and reverse the mode in a single click.
Key Features
- Two-way conversion: Escape plain XML into entities, or unescape entity encoded XML back into its original form, from the same interface.
- Optional quote escaping: Choose whether double quotes and apostrophes are converted to
"and', useful when your text is only going into element content rather than an attribute value. - Non ASCII encoding: Convert unicode characters outside the standard ASCII range into numeric character references, which helps when a downstream system expects plain ASCII XML.
- Live auto convert: See escaped or unescaped output update as you type, with the option to switch to manual conversion.
- File upload and download: Bring in a .xml or .txt file directly, and save your result as a file instead of copying it manually.
- Swap panels: Instantly reverse input and output and flip the mode, handy when you need to check a round trip conversion.
- Live stats: Character count, line count, and file size shown for both input and result.
- Runs in your browser: No content is sent to a server, so the tool is safe to use with internal or sensitive XML data.
Common Uses for XML Escaping and Unescaping
Escaping is required any time literal text needs to sit inside XML without being mistaken for markup. Common situations include:
- Embedding user submitted text, comments, or messages inside an XML document or API payload.
- Serializing data from a database or object into XML, where field values may contain
&,<, or quotes. - Preparing code snippets or log output for inclusion in XML based configuration or documentation formats.
- Debugging: unescaping lets you take a chunk of escaped XML from an API response or log file and read it in its original, human readable form.
- Converting between formats, where XML output needs to be decoded before further processing in JSON or plain text.
A quick reference for the five predefined entities:
| Character | Name | Entity |
|---|---|---|
< | Less than | < |
> | Greater than | > |
& | Ampersand | & |
" | Double quote | " |
' | Apostrophe | ' |
These are the only five entities the XML 1.0 specification predefines, and every conformant parser recognizes them.
XML Escape and XML Unescape Tool FAQs
Do I need to escape all five characters every time?
Not always. Inside element content, only <, >, and & strictly need escaping. Inside a double quoted attribute value, you also need to escape ". Inside a single quoted attribute value, you need to escape ' instead. The tool includes an option to escape quotes so you can match either context.
Is the apostrophe entity the same in XML and HTML?
No. XML only defines ' for the apostrophe. HTML also accepts ', and older browsers sometimes do not recognize ' at all. When working with XML specifically, ' is the correct and only standard entity.
Do I need to escape characters inside a CDATA section?
No. Text inside a <![CDATA[ ... ]]> block is treated as literal character data, so ampersands, angle brackets, and quotes do not need escaping there. The one exception is the sequence ]]> itself, which ends the CDATA block early if it appears inside the content.
What does the non ASCII encoding option do?
When turned on, any character outside the standard ASCII range is converted into a numeric character reference, such as € for the euro sign. This is useful when a system downstream expects pure ASCII XML rather than UTF-8 characters.
Is my data uploaded anywhere when I use this tool?
No. All escaping and unescaping happens locally in your browser using JavaScript. Nothing you paste, upload, or convert is sent to a server or stored.
Can I convert an entire file instead of pasting text?
Yes. Use the Upload button to load a .xml or .txt file directly into the input, and use Download to save your converted result as a file.