Free XML Escape / Unescape

How to Escape and Unescape XML Entities

Type or paste text containing XML-special characters in the left panel and the escaped version with entity references appears instantly on the right. To unescape, paste XML text with entities like & and < in the right panel and the original text with literal characters appears on the left. The built-in entity reference table shows all 5 predefined XML entities for quick reference.

Understanding XML Entity Escaping

XML uses angle brackets to delimit tags and ampersands to start entity references. When these characters appear as literal text content, they must be replaced with predefined entity references to avoid ambiguity. The XML specification defines exactly 5 such entities. Proper escaping is critical for generating well-formed XML and preventing injection attacks when constructing XML from user input.

Frequently Asked Questions

What are the 5 predefined XML entities?

XML defines 5 predefined entities: &amp; for &, &lt; for <, &gt; for >, &quot; for ", and &apos; for '. These characters have special meaning in XML syntax and must be escaped when used as literal text content.

Why do XML characters need to be escaped?

Characters like < and & have special meaning in XML — < starts a tag and & starts an entity reference. If these characters appear in text content without escaping, the XML parser will misinterpret the document structure, causing parse errors or security vulnerabilities.

Can I unescape XML entities back to text?

Yes — the tool is bidirectional. Paste XML containing entities like &amp; and &lt; in the right panel and the unescaped text with literal characters appears instantly in the left panel.

Is this tool free?

Yes — completely free, forever. No sign-up, no account, no usage limits.

Is my data safe?

All escaping and unescaping happens locally in your browser using JavaScript. Nothing is uploaded to any server. It's safe to use with sensitive or proprietary data.

Does this handle numeric character references?

This tool handles the 5 predefined named entities (&amp;, &lt;, &gt;, &quot;, &apos;). Numeric character references like &#60; or &#x3C; are not currently converted, though these are less common in practice.