XML escape and unescape

What an XML escape does to a string

An XML parser reads two keyboard characters as structure no matter where they appear. The ampersand announces a reference and the less-than sign announces a tag, so a value like R&D < 2025 dropped straight into a document stops the parser cold. Escaping swaps each such character for an entity the parser decodes back to the original: &, <, >, " and '. Those five are the complete list of names XML predefines. Everything else you might want to name has to be written as a number, such as   for a no-break space.

This page writes all five in every position, even where the grammar would tolerate the raw character. A stray > is only illegal in element content when it closes the sequence ]]>, and quotes only matter inside an attribute delimited by that same quote. Escaping them anyway costs a few bytes and removes a class of bugs that appear only when two values end up next to each other.

Element text or attribute value

The two places a string can go in XML are not treated alike. Inside an element, a tab or a line break is kept exactly. Inside an attribute, the specification tells the parser to normalize the value first, and each raw tab, line feed and carriage return turns into a plain space before your program receives it. A multi-line description stored in title="…" therefore arrives as a single line. The only way to keep the whitespace is to write it as 	 and 
, which is what the Attribute value choice does. Element text is the default because spelling every line break as a reference makes ordinary paragraphs unreadable without changing what a parser returns. If you leave it on element text and your input holds tabs or line feeds, the page says so above the result.

Characters XML 1.0 refuses outright

Unlike most formats, XML has characters with no legal spelling at all. The XML 1.0 grammar permits tab, line feed and carriage return below U+0020 and nothing else, and it excludes U+FFFE, U+FFFF and unpaired surrogates as well. The rule covers character references, so � is not a clever way around it — a conforming parser reports a fatal error and discards the document. XML 1.1 relaxed this for most control codes when written as references, yet support for 1.1 is rare enough that relying on it is a gamble. When such a character appears in your input, the escaped result carries the replacement character U+FFFD in its place, and a notice counts each kind before you copy anything. Should those bytes really belong in the data, XML is the wrong container; encode them as base64 first.

Unescaping, and the   trap

Reading escaped XML back decodes the five named entities and any numeric reference that points at a permitted character. The mistake people make most often is borrowing names from HTML.  , © and é look reasonable and are simply undefined in XML unless a DTD declares them, so a parser halts with an undefined-entity error. This tool never decodes them as if they were valid: each is left untouched, flagged with its position, and paired with the numeric reference that means the same character. The same honesty applies to & (entity names are case-sensitive), to A (XML insists on a lowercase x), to references to forbidden code points, and to a bare ampersand. If your text is HTML after all, the HTML escape tool reads every name a browser knows.

Carriage returns survive only from a file

Paste text into the field and any Windows line endings are gone before this page can look at them, because a browser flattens CR LF to LF inside every textarea. The counter under the field reports what really arrived. Open the file instead and it is decoded from its bytes, so the carriage returns are still there and are written out as 
. That reference is not optional decoration: an XML parser applies its own end-of-line handling to raw markup and would otherwise hand your program a lone line feed.

Related XML and string tools

Escaping handles one value at a time. To check that a finished document is well-formed or matches a schema, run it through the XML validator, and to make a dense document legible use the XML formatter. When the same string is headed for a JSON payload rather than markup, the JSON escape tool spells it with backslashes. Converting a whole document into JSON is the job of the XML to JSON converter, and characters that stay invisible after unescaping can be identified with the invisible character inspector.

Nothing leaves this tab

The escaping and unescaping happen in JavaScript on this page, and very large inputs move to a background worker served from this site. No request carries your text, the address bar never picks up a copy of it, and there is no server-side log where it could be recorded. Configuration files, SOAP bodies and feed entries are exactly the kind of text that should not be pasted into a service you cannot inspect, so open the network panel while you work if you want to see for yourself.