Escape / Unescape

XML Escape / Unescape

The five XML entities, handled both directions — make any text safe inside elements and attributes.

In short

Escape and unescape XML online: the five predefined entities (& < > " ') and numeric references, converted both directions instantly.

By NaveenKumar T · Updated 17 Sep 2026

Learn: HTML Entities Explained: When to Escape &, <, > and Quotes

Escape & unescape in one tool
Handles every special character
Instant as you switch modes

Runs entirely in your browser — nothing you paste or open here is uploaded, logged, or stored.How we handle data →

Example

XML Escape: input and output

Preparing a supplier note for a <description> element in a SOAP message.

Text

Vendor: Müller & Söhne <sales@example.com>
Spec: M8 'hex' bolt, "A2-70", length < 40 mm

Escaped XML

Vendor: Müller &amp; Söhne &lt;sales@example.com&gt;
Spec: M8 &apos;hex&apos; bolt, &quot;A2-70&quot;, length &lt; 40 mm

All five predefined entities appear in the output — &, <, >, " and ' — while the umlauts are left alone because XML is Unicode-native.

Learn more

XML escaping rules

XML predefines exactly five entities, and unlike HTML there are no others without a DTD: & for &, < for <, > for >, " for double quote, ' for apostrophe. Escaping text before placing it in element content or attribute values prevents the classic 'unescaped ampersand' error that breaks feeds and SOAP messages — the single most common cause of invalid XML in the wild.

Unescaping decodes those five plus numeric character references (©, —), which generators emit for characters outside ASCII. Note that HTML-only named entities like   are NOT valid XML — if your document contains them, it was HTML all along; use the HTML Escape tool's unescape instead.

The five predefined XML entities

XML defines exactly these five — no DTD, no configuration, no browser quirks to account for. Everything else (©, é, emoji) is either written as the literal UTF-8 character or as a numeric reference; there is no such thing as a sixth named XML entity without declaring it yourself in a DTD.

XML's five predefined entities
Character	Entity	Where it must be escaped
&	&	Always — in text content and in attribute values
<	<	Always — a raw < is read as the start of a tag
>	>	Strictly only inside the literal sequence ]]>, but escaping it everywhere is always safe
"	"	Inside an attribute value delimited by double quotes
'	'	Inside an attribute value delimited by single quotes

Help

Frequently asked questions

Everything you need to know about the XML Escape.

01How do I escape or unescape XML here?

Paste your text, pick Escape or Unescape in the Mode select, and press Convert. Escape converts to the five predefined XML entities (& < > " '); Unescape decodes those plus numeric character references.

02Why did my XML break on a & that 'worked' before?

An ampersand followed by characters that happen to look like an entity (&copy in a URL query, say) may parse in lenient HTML but is fatal in XML: every & must start a valid entity or be written &. Run your text through Escape mode before inserting it into XML and the problem disappears permanently.

03Do I really need to escape > and quotes, or only & and <?

Strictly, XML text content only forbids a raw & and <; > is illegal only in the sequence ]]>, and quotes matter only inside attribute values. Escape mode converts all five anyway, so the result drops safely into element content or an attribute delimited by either quote style. It is unconditional, though: already-escaped input is escaped again (& becomes &amp;), so run it exactly once. Unescape restores the five entities plus decimal and hex references such as © and —.

Keep working