XML escape and unescape — the five predefined entities

How to use the XML encoder and decoder

1. Set Direction to Encode to escape text, or Decode to unescape it.
2. Paste your text into Input.
3. When encoding, keep Escape quotes (needed in attribute values) ticked unless the text only goes between tags.
4. Tick Write non-ASCII as numeric references if the target cannot store UTF-8.
5. Copy the Encoded or Decoded result.

What it does and when to use it

An XML parser stops with an error at a bare & or < in text, because those characters start entities and tags. Escaping is needed whenever you place user text, product names, URLs with query strings or code snippets into an XML file by hand: RSS and Atom feeds, sitemaps, SVG, Android string resources, Maven or .NET config files, SOAP messages.

Decoding helps when you need the original text back from a feed or a config value, for example a URL in a sitemap written as ?a=1&b=2.

If you are working with HTML instead, the HTML encoder and HTML decoder know the full list of HTML named entities. For numeric references only, use the numeric HTML entities tool. If the value is going into a URL rather than XML, use the URL encoder.

How it works

The XML 1.0 specification predefines exactly five entities. Encoding replaces each character in one pass:

With the non-ASCII option on, every character above code 127 becomes a decimal reference such as é. Decoding turns the five entities and any decimal or hex numeric reference back into characters; anything else stays as written. Everything runs in your browser.

Worked examples

<a>Fish & Chips</a>                          →  &lt;a&gt;Fish &amp; Chips&lt;/a&gt;
<note lang="en">Fish & Chips 'tonight'</note> (quotes off)
                                             →  &lt;note lang="en"&gt;Fish &amp; Chips 'tonight'&lt;/note&gt;
Café ✓  (non-ASCII as references)            →  Caf&#233; &#10003;
&lt;b&gt; &apos;x&apos; &#233; &nbsp;  (Decode) →  <b> 'x' é &nbsp;

Limits and tips

• Escaping is not validation. The tool does not check that your XML is well formed.
• Control characters that XML 1.0 forbids, such as most bytes below 32, are not removed. Strip them before escaping if your data may contain them.
• For large blocks of code inside XML, a CDATA section can be easier to read than escaping every character.