XML Escape / Unescape
Escape the five XML special characters or decode entities back to text, in your browser. Handles numeric entities too. Free, instant.
About this tool
Escape text for safe inclusion in XML: the five characters with reserved meaning (& < > " ') become their entities (& < > " '). Switch the direction option to unescape, which also decodes numeric character references like é and 💩.
Unescaped ampersands and angle brackets are the most common cause of 'not well-formed' XML errors, especially in hand-built SOAP requests, RSS feeds, and configuration files.
Common uses
- Prepare text containing & or < for an XML element or attribute.
- Decode entity-riddled content copied from a feed or SOAP response.
- Fix a 'not well-formed' error caused by a raw ampersand.
Automate via API
The same conversion is available as a REST endpoint for scripts, pipelines, and backends:
curl -X POST https://payloadly.com/api/v1/tools/xml-escape \ -H "Content-Type: text/plain" \ -H "X-Api-Key: YOUR_API_KEY" \ --data-binary @input.txt
Frequently asked questions
Is my data uploaded to a server?
No. This tool runs entirely in your browser using JavaScript, and there are no ads on the page. Nothing you paste or drop here is uploaded, logged, or stored, and you can verify that yourself: open your browser's developer tools and watch the Network tab while you convert (no requests leave the page), or disconnect from the internet after the page loads and keep working.
Which characters must be escaped in XML?
Only & and < are mandatory everywhere; > is required in the sequence ]]>, and quotes only need escaping inside attribute values that use the same quote. Escaping all five is the safe, conventional habit, and it is what this tool does.
Is there a size limit or a fee?
The browser tool is free with no signup and comfortably handles files up to tens of megabytes (limited by your device's memory). For automated or bulk processing inside your own scripts and pipelines, use the paid REST API.
Related tools
Convert text case in your browser: uppercase, lowercase, title, sentence, camelCase, snake_case, kebab-case, and more. Free, instant.
Generate cron expressions from plain English or decode one into a schedule with its next 5 run times. Runs in your browser, free.
Generate Discord timestamp codes from any date. All 7 <t:unix:style> formats with previews; every reader sees their own timezone.
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes of text in your browser. Nothing leaves the page; ideal for checksums. Free, instant.