Free XML Escape / Unescape Tool Online
Escape or unescape XML special characters instantly — free, browser-only, no upload needed.
XML Input
Escaped Output
XML Escape Examples
Special characters (&, <, >, ", ') must be escaped in XML. Telecom-themed example:
Call log with special characters
Raw XML (note contains <, &, quotes):
Escaped output:
Use Sample above to load a call log into the editor.
What Is XML Escape/Unescape?
XML reserves certain characters for markup: &, <, >, ", and '. When these appear in text content or attribute values, they must be escaped as entities (&, <, etc.) or the parser will misinterpret them. The W3C XML specification defines entity references. Unescaping does the reverse—it turns entities back into the actual characters.
Pick Escape or Unescape with the toggle at the top. Whichever you choose, the entity substitution is done locally by the page, so production XML or anything sensitive is fine to paste in.
How to Use This Tool
Choose Mode and Paste
Select Escape to convert special characters to entities, or Unescape to convert them back. Paste your XML (or escaped text) into the left editor, or upload a file. Use the toggle button to switch between modes.
View the Output
The right panel updates automatically. In Escape mode, reserved characters become entities. In Unescape mode, entities become the actual characters. Invalid or malformed input may produce unexpected results—validate with XML Validator if needed.
Copy or Download
When the entities look right, Copy grabs the text and Download stores it in a file. Escaping for JSON instead? Use JSON Escape. For URL encoding, use XML URL Encode.
When XML Escaping Matters
When embedding user input or dynamic content in XML, unescaped < or & can break parsing or create security issues. Escaping ensures the content is treated as text, not markup. When you receive double-escaped XML (e.g. from a database or API that stores XML as a string), unescaping removes the extra layer so you can parse it correctly.
Frequently Asked Questions
When do I need to escape?
When embedding user input or special characters in XML text content or attributes. Browsers and parsers expect entities for reserved chars. Unescaped < can be interpreted as the start of a tag; & as the start of an entity.
What about CDATA?
CDATA sections (<![CDATA[...]]>) avoid escaping for large blocks of text. But ]]> must still be escaped or split inside CDATA, as it ends the section. The W3C XML spec defines CDATA rules.
Is my data private?
Yes. Turning special characters into entities and back is simple string work done by script in your tab. Keep the DevTools Network tab open while you use it and you'll see your XML never goes out in a request.
What XML characters must be escaped?
Five characters are reserved in XML and must always be escaped: & → &, < → <, > → >, " → ", and ' → '. The ampersand and less-than sign are strictly required; the others are required in specific contexts (e.g. quotes inside attribute values).
Related Tools
For more on XML escaping and entities, see the W3C XML entity references, the W3C XML specification, and W3C XML. For parsing XML in the browser, see MDN DOMParser. For HTML entities, see HTML named character references. For JSON escaping, see the JSON specification.