XML Escape/Unescape

Escape and unescape XML strings — properly encode special characters for XML documents.

EscapeUnescapeXMLEntities
Plain Text
43 chars
Escaped Output

Output will appear here

Start typing to see live output

All escaping/unescaping happens locally in your browser — your data never leaves your device.

XML Escape converts special XML characters to their entity equivalents (<, >, ", ', &).

This tool lets you escape text for safe inclusion in XML documents and unescape XML entities back to readable text.

Critical for properly formatting XML data and preventing parsing errors when dealing with special characters.

Escaping XML Elements

Input: <data>Price: 5 < 10 & 10 > 5</data>
Output: &lt;data&gt;Price: 5 &lt; 10 &amp; 10 &gt; 5&lt;/data&gt;

XML tags and comparison operators are escaped for safe storage in text content.

Escaping Quotes in Attributes

Input: id="123" and name='test'
Output: id=&quot;123&quot; and name=&apos;test&apos;

Both single and double quotes are escaped properly.

Unescaping XML Entities

Input: &lt;note&gt;&amp; &quot;alert&quot;&lt;/note&gt;
Output: <note>& "alert"</note>

XML entities are converted back to their original characters.

XML parsing fails after unescaping

The original XML may have been double-escaped or contain invalid character sequences.

Verify the XML is well-formed and entities are correctly formatted (&name;).

Ampersands disappear or multiply

Multiple escape/unescape cycles can cause issues. Start fresh from the original source.

Only escape once and store the result. Unescape when you need to use it.

Why is XML escaping different from HTML?

XML requires escaping both single and double quotes (&apos; and &quot;), while HTML uses &#39; for single quotes. XML is stricter about entity requirements.

What characters must be escaped in XML?

Five characters must always be escaped: < (&lt;), > (&gt;), " (&quot;), ' (&apos;), and & (&amp;). The & must be first to avoid double-escaping.

Can I use CDATA sections instead?

Yes, CDATA sections allow you to include unescaped text, but they cannot contain ]]>. For most cases, using entities is simpler and more compatible.

Is my data secure?

Yes. All processing happens locally in your browser. Your data never leaves your device.