01
Select the destination
Text mode keeps quotation marks. Attribute mode escapes only the quote used by the surrounding attribute; it does not add the surrounding quotes or a tag.
XML tools
XML escapefor the receiving context
Choose a text node or an attribute value before escaping.
XML escape
Input
Result
Conversion stays in this browser; input is not uploaded.
Conversion options
Context affects escaping only. Batch separators stay literal; a decoded newline belongs to its record. The JSON report preserves those boundaries.
Input ≤ 1,048,576 UTF-16 units; output ≤ 6,291,456; batch ≤ 10,000 records; report ≤ 16,777,216 units.
38 → 48 units · 3 replacements · 1 records
XML escape is useful when an ampersand in a product name breaks a feed, or a quoted value must fit inside an attribute. The destination matters: text content and quoted attributes do not need identical replacements.
XML unescape restores one encoded layer. It reads entity references in a content string without parsing tags, loading a DTD or treating the input as a complete document.
Why use XML escape?
Keep whitespace meaningful
XML escape encodes a carriage return as a numeric reference. Attribute mode also protects tabs and line feeds, plus the selected quote. This preserves values when inserted into ordinary CDATA-type attributes.
Keep batch records separate
Restoring a numeric newline reference can create extra lines inside one record. The JSON report stores each input, output and original separator separately, so those new lines do not erase record boundaries.
Choose context and inspect the boundary
02
Control refresh timing
Automatic conversion runs after 350 ms. Turn it off to reveal Convert, or press Ctrl/Cmd+Enter. An edit immediately disables export until the new conversion succeeds.
03
Review replacements before applying
Example and Clear show a replacement preview and character counts. Apply confirms the change; Undo restores the previous input and result. Long output grows in 20,000-unit preview chunks.
References, locations and record values
Five named entities
XML escape keeps XML entities distinct from HTML names. Decoding recognizes amp, lt, gt, quot and apos, with exact case and a required semicolon.
Numeric character references
Decimal references such as A and hexadecimal references such as A both restore A. The hexadecimal prefix must use lowercase x; its digits may use either case.
Locate rejected input
XML special characters can be encoded, but forbidden XML 1.0 characters cannot be repaired by spelling their numeric value. The first error reports the original line and UTF-16 column; the whole run fails.
Content strings and explicit limits
- A value, not a document
- XML escape does not validate element names, tag nesting, schemas or attribute syntax. Decoding retains ordinary raw angle brackets and quotes; it checks references, not the document around them.
- One layer, five built-in names
- &lt; becomes < in one run. Unknown HTML names such as , custom DTD entities, bare ampersands and incomplete references fail. No recursive decoding or external entity resolution occurs.
- XML 1.0 character range
- NUL, forbidden C0 controls, isolated surrogates and U+FFFE/U+FFFF are rejected, including numeric references to them. Legal supplementary characters remain intact; U+1FFFE is allowed by XML 1.0.
- Whitespace is not normalized here
- Encoding protects CR, and in attribute mode TAB/LF as well. Decoding preserves raw whitespace. The attribute guarantee concerns CDATA-type attributes; DTD tokenized attributes may still normalize spaces.
- Lines are records in batch mode
- CRLF, CR and LF delimit records; empty and final empty records count. Separators remain literal. A decoded adds a newline inside a value, so TXT is not an unambiguous record format. Use the JSON records array.
- Bounded local conversion
- Input: 1,048,576 UTF-16 units; output: 6,291,456; batch: 10,000 records; JSON report: 16,777,216 units. Limits fail wholly. No file import, URL fetch, CDATA wrapper, all-ASCII mode or silent character removal is provided.
XML escape questions
Which entity names does XML recognize by default?
The five predefined names are amp, lt, gt, quot and apos. They represent &, <, >, double quote and apostrophe. Names are case-sensitive; this XML escape tool rejects other names instead of guessing a definition.
Can HTML entity names also be used in XML?
Not generally. HTML has many built-in names that XML does not. For a nonbreaking space, use a literal valid Unicode character or   rather than . Custom declarations are outside this tool.
Which situations require XML character escaping?
Escape a data value before inserting it into markup: at least ampersands and less-than signs need attention. The tool also encodes greater-than signs to avoid a literal ]]> sequence, and offers context-specific quote and whitespace handling.
When is a CDATA block preferable to escaping?
CDATA can hold text with many angle brackets, but it cannot appear inside an attribute and cannot contain its own ]]> terminator. This page does not generate CDATA sections.
Will malformed references stop an XML parser?
A conforming XML parser reports malformed or undeclared references. This decoder also rejects unknown or incomplete references, but a successful result does not certify that the surrounding XML document is valid.
Found an unexpected result?
Try a representative value
Use XML escape with an ampersand, quotes and a line break, then compare text and attribute output.