XML Escape / Unescape
Escape text for XML attributes and text nodes, or decode XML entities.
XML Escape and Unescape Online
Use this XML escape tool to make any text safe for an XML document, RSS feed, SVG file, SOAP message, Android string resource, or Maven pom.xml. It replaces reserved characters with the entity references every XML parser understands. The Unescape mode does the opposite and decodes entities and numeric character references back into plain text.
The five predefined entities
Unlike HTML, XML knows only five named entities out of the box:
&→&<→<>→>"→"'→'
So <to>Tom & Jerry's</to> as a value becomes <to>Tom & Jerry's</to>. Writing or é in XML makes the whole document invalid; the unescaper here therefore decodes only the five predefined names plus decimal (é) and hex (é) references.
Text nodes vs attributes
In a text node, only < and & are strictly required to be escaped (and > when it follows ]]). In an attribute value the delimiting quote must be escaped too, and literal line breaks inside attributes are normalised to spaces by the parser. Keep Escape quotes on when the result goes into attributes such as title="..."; switch it off to get cleaner text-node content.
CDATA sections
An alternative for large blocks of code is <![CDATA[ ... ]]>, which tells the parser to treat everything inside as character data. It saves escaping in text nodes but cannot appear in attributes, and the text must not contain ]]>. When in doubt, escape.
Typical bugs
The most common XML error is an unescaped ampersand in a URL, e.g. ?id=5&lang=en inside a sitemap. Another is double escaping, which shows &amp;. For HTML documents use HTML Escape / Unescape; for Base64 transport see XML to Base64.
Frequently Asked Questions
What are the five predefined XML entities?
XML defines exactly five named entities: & (&), < (<), > (>), " (") and ' ('). Any other named entity such as or © is an error unless it is declared in a DTD. Use numeric references like   or © instead.
Do I have to escape quotes in XML?
Only inside attribute values, and only the quote that delimits the value: " inside a double-quoted attribute, ' inside a single-quoted one. In text nodes quotes are allowed as-is. Turn off "Escape quotes" to keep text-node content more readable.
Should I use CDATA instead of escaping?
A <![CDATA[ ... ]]> section lets you include < and & in a text node without escaping, which is handy for embedded scripts or HTML. It cannot be used inside attributes and cannot contain the sequence ]]>. Escaping works everywhere, so most XML libraries simply escape.
Why does the parser say 'EntityRef: expecting ;' or 'undefined entity'?
A bare & was left unescaped (for example in a URL query string like ?a=1&b=2), or an HTML-only entity such as was used. Escape the ampersand as & and replace HTML entities with numeric character references.