Escape text for XML
Convert &, <, > and quotes into XML entity references so a fragment can be embedded safely in element text or an attribute value.
- Runs in your browser
- Nothing you enter is sent
- Free, no account
Your XML never leaves this tab — check it yourself—
Starting the network probe…
The counter above wraps fetch, XMLHttpRequest and navigator.sendBeacon in this tab and counts every call. It does not block anything — it just reports.
Two ways to verify independently
- Turn off Wi-Fi or enable airplane mode, then use the tool. It keeps working, because the page is already fully loaded.
- Open your browser devtools, switch to the Network tab, clear it, and run the tool. No new row appears.
Why this matters
In 2025 researchers found that popular online formatters had retained tens of thousands of user-submitted snippets — JSONFormatter.org and CodeBeautify together exposed roughly 80,000 saved documents, many containing live cloud credentials, private keys and internal database connection strings, because “format this” quietly meant “upload this”. A separate incident exposed roughly 3.5 million user PDFs on a document-conversion service. The only structural fix is not sending the data in the first place: this site is served under a Content-Security-Policy whose connect-src contains no third-party origin, so a request off this device cannot be made even by accident.
The five characters that matter
| Character | Entity | Required in text? | Required in an attribute? |
|---|---|---|---|
& | & | Yes | Yes |
< | < | Yes | Yes |
> | > | Only after ]] | No |
" | " | No | Yes, if the attribute uses double quotes |
' | ' | No | Yes, if the attribute uses single quotes |
The tool escapes the greater-than sign by default even though it is rarely required. The reason is
the ]]> sequence: if it appears in text, a parser reads it as the end of a CDATA
section that was never opened. Escaping every > makes that impossible, costs three
characters, and is what most serialisers do.
Escape at insertion, never afterwards
The reliable rule is that escaping belongs at the moment a value is placed into markup, applied to
that value alone. Escaping a whole document after assembling it double-escapes the markup you
wrote. Escaping before storing means the escaped form leaks into every other consumer of that
data — a report, a CSV export, a search index — where it appears as literal
& text.
In practice this means using your XML library’s text-node API rather than string concatenation. This page exists for the cases where you are hand-writing a fragment, pasting a value into a config file, or debugging why a value came out wrong.
Do not escape non-ASCII
Some older tools convert every accented letter to a numeric reference, producing
é for é. XML documents are Unicode, normally UTF-8, so this is unnecessary:
it makes the file larger, harder to read and harder to diff, and it gains nothing. Declare the
encoding in the XML declaration and type the characters.
CDATA is not a substitute
A CDATA section lets you include raw < and & without escaping,
which makes it tempting for embedding HTML or a script inside XML. Two catches. First, the
sequence ]]> cannot appear inside CDATA at all — there is no escape for it, you
have to split the section. Second, CDATA is a lexical convenience, not a data type: to a parser
the content is ordinary text, so anything reading the document with an XPath or a DOM API sees
exactly the same string either way. Escaping is simpler and always works.
XML escaping versus HTML escaping
They overlap but are not interchangeable. Text escaped for XML is always safe in HTML, because the five XML entities all exist in HTML. The reverse is false: HTML has around two thousand named entities, and an XML parser rejects every one it does not know. If you are moving content from an HTML context into XML, run it through unescape first and re-escape here.
Questions
Which characters have to be escaped in XML?
In element text, & and < always. In an attribute value, also the quote character you used as the delimiter. > is not strictly required in text but is escaped here by default, because leaving it raw can create an accidental `]]>` inside CDATA-adjacent content.
Why are there only five entities?
XML defines & < > " and ' and nothing else. Any other named entity has to come from a DTD. That is why HTML entities such as break an XML parser — use a numeric reference like   instead.
Should I escape non-ASCII characters?
No. XML documents are Unicode, normally UTF-8, so accented letters, CJK text and emoji can appear literally. Escaping them to numeric references makes the file larger and harder to read for no benefit.
Is this the same as HTML escaping?
Almost, but not quite: HTML has around 2,000 named entities and XML has five. Text escaped for XML is always safe in HTML; text escaped for HTML may contain entities that an XML parser rejects.