⌘ K
xml entities · 5 chars · escape · unescape · live

Escape and unescape XML

Convert the five XML special characters (& < > " ') to entities and back. Stricter than HTML — only XML's five named entities are used. All processing runs locally.

XML Escape
Input
38 B
1 lines
Output
64 B
1 lines
Status
ready
live
Ratio
1.68×
out/in
input · xml
output · escaped
&lt;note attr=&quot;hi&quot;&gt;Hello &amp; welcome&lt;/note&gt;
Quick Start

How to escape XML

XML defines exactly five predefined entities: &amp;, &lt;, &gt;, &quot;, &apos;. Anything else must use numeric character references — this tool stops at the five basics.

  1. 01

    Paste XML or escaped text

    Raw XML fragments, or text already escaped with the five entities.

    Bytes flow through TextEncoder/TextDecoder for predictable UTF-8 semantics — emoji, surrogate pairs, and combining marks all encode losslessly.

    inputUTF-8TextEncoderlosslesslive
    input · raw bytesxml · UTF-8
    <a href="x">Y</a>
    loaded · UTF-8MIME · ready
  2. 02

    Pick direction

    Escape for embedding text into XML; unescape to recover originals.

    Hash and signature operations call crypto.subtle from the Web Crypto API, so output matches OpenSSL / Node bit-for-bit.

    modeWeb Cryptosubtledeterministiclive
    mode · optionsescape · live
    & → &amp;
    options applied · livelive
  3. 03

    Live convert

    Output updates as you type.

    Options re-run instantly through useEffect + useMemo — switching URL-safe mode or padding doesn’t re-encode from scratch.

    livememoisedoptionsinstantreactive
    out · encodedok · ready
    &lt;a href=&quot;x&quot;&gt;Y&lt;/a&gt;
    encoded · livelossless
  4. 04

    Copy or download

    One click to clipboard. Download as .txt.

    Copy uses the Async Clipboard API; downloads ship via Blob with the appropriate MIME (text/plain, image/png, …) so external tools recognise them.

    exportclipboardblobMIME-correctclient-side
    ok · copiedready · done
    Copied
    shipped · ready to shipsuccess
Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren&rsquo;t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Related toolsHTML EncoderHTML DecoderHTML Entity LookupAttribute EncoderURL EncoderUnicode Converter
Use Cases

When to escape XML

SVG, RSS, SOAP, config files, sitemaps.

RSS / Atom feeds

Escape titles and descriptions before embedding. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

SVG content

Inline text in SVG needs XML escaping. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

SOAP envelopes

Body content must use the five predefined entities only. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

Sitemap XML

URLs with & inside <loc> must be &amp;. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

Config files

Many configs (Maven, Ant, Tomcat) are XML. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

DocBook / DITA

Authoring formats that don't allow HTML entities. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready
FAQ

Frequently asked questions

XML's predefined entity set is exactly amp, lt, gt, quot, apos. Anything else must use a DOCTYPE declaration or numeric character references — using &copy; or &nbsp; in raw XML is invalid.
Pass through unchanged — XML files are UTF-8 (or whatever the XML declaration says) and don't need escaping for non-ASCII characters.
HTML escaping allows &apos; only in XHTML. HTML doesn't define &apos; — use &#39; in HTML attribute values.
Inside CDATA, only ]]> needs special handling — the five entity escapes don't apply. Use CDATA when escaping every character would be unreadable.
No. Escaping runs locally in your browser.
Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

Sent straight to the maintainers · no account needed
47 in queue·8 shipped this month
Request queued. Thanks!