Free XML escape & unescape tool — the five predefined XML entities

Escaping runs entirely in your browser — nothing is uploaded.

📃 XML Escape / Unescape — Free Online Tool

Escape and unescape XML entities online, free. XML escaping replaces the five characters with special meaning in XML — &, <, >, ", ' — with their predefined entities so they are treated as data, not markup. This tool escapes text into XML-safe form, or unescapes the five entities back to characters, entirely in your browser.

🚀 Why use this XML Escape / Unescape tool?

It emits the strict five predefined XML entities (including '), so output is valid in any XML document or attribute value. 100% free, no registration, and complete privacy — everything runs locally in your browser, so your data never touches a server.

Key Features

📐Strict five entities

Escapes &, <, >, " and ' to &amp;, &lt;, &gt;, &quot; and &apos; — the predefined XML set.

🔁Escape & unescape

Convert text to XML-safe entities, or decode them back to the original characters.

⚡Instant & in-browser

Runs locally with no upload and no wait.

🔒100% private

Your XML documents, attributes and content never leave your device.

Popular Use Cases

Building XML

  • • Embed text in elements/attributes
  • • Escape & and < in content
  • • Hand-author config/SOAP/RSS

Debugging

  • • Decode entities from a feed
  • • Inspect escaped attribute values
  • • Fix invalid XML text

Interop

  • • Prepare values for XML APIs
  • • Sanitize before serialization
  • • Round-trip data

What It Handles

Modes

  • ✓ Escape (text → entities)
  • ✓ Unescape (entities → text)

Handles

  • ✓ & < > " '
  • ✓ &apos; (XML)
  • ✓ Attribute & content text

Privacy

  • ✓ Client-side only
  • ✓ No network calls
  • ✓ Runs offline

Sources & References

Frequently Asked Questions

Which characters must be escaped in XML?

XML defines five predefined entities. Two are mandatory in text content — the ampersand & (as &amp;) and the less-than sign < (as &lt;). In attribute values you also escape the matching quote — " as &quot; or ' as &apos;. The greater-than sign > is commonly escaped as &gt; to avoid the ]]> sequence, though it is only strictly required there.

What is the difference between XML and HTML escaping?

XML has exactly five named entities and uses &apos; for the apostrophe. HTML has hundreds of named entities and uses &#39; (not &apos;) because &apos; was not part of HTML 4. This tool's XML mode emits &apos; and the strict five-entity set; use HTML Escape for web pages.

Do I need to escape characters inside CDATA?

No. Text wrapped in a <![CDATA[ ... ]]> section is taken literally, so < and & need no escaping there — the only forbidden sequence is the terminator ]]>. Outside CDATA, use this tool to escape the predefined entities.

Is my XML sent to a server?

No. Escaping and unescaping run entirely in your browser. Your XML documents, attribute values and content never leave your device.

How do I unescape XML entities back to characters?

Paste text containing entities like &lt;tag&gt; and click Unescape. The tool converts &amp; &lt; &gt; &quot; and &apos; back into &, <, >, " and ', recovering the original markup or text.

🎓 Pro Tips

  • Tip 1: In text content you only strictly need to escape & and <; escape " and ' inside attribute values to match the delimiter.
  • Tip 2: Use a CDATA section for large literal blocks (like embedded code) instead of escaping every character.
  • Tip 3: XML uses &apos;; HTML uses &#39; — don't mix them, or older HTML parsers may show a literal &apos;.