XML Escape / Unescape
Escape XML special characters into entities, or unescape entities back to text. Runs entirely in your browser.
How to use XML Escape / Unescape: Open XML Escape / Unescape — it runs entirely in your browser with no setup. Paste or type your input into the text area, or upload a file where supported. Set any options you need. The result appears in the output panel — there is no upload step and no waiting on a server. Everything runs inside your browser, so your data never leaves your device.
Tip: drag a text file onto the box above to load it — drop several to append them in order.
Escaped XML
Escape XML special characters into entities, or unescape entities back to text. Runs entirely in your browser. XML Escape / Unescape is a free, browser-based tool in the Filevane developer tools collection — there is nothing to install, no account to create and no watermark on your results. It works on desktop, tablet and mobile, and because the work happens on your own device it stays fast even with large inputs.
How to use XML Escape / Unescape
- Open XML Escape / Unescape — it runs entirely in your browser with no setup.
- Paste or type your input into the text area, or upload a file where supported.
- Set any options you need. The result appears in the output panel — there is no upload step and no waiting on a server.
- Review the output instantly; large inputs are handled locally without lag.
- Copy the result to your clipboard or download it. Your data never leaves the page.
Why use XML Escape / Unescape?
- 100% free with no limits, no sign-up and no watermarks.
- Private by design — your data are processed in your browser and never uploaded to a server.
- Fast and lightweight, with instant results even on a phone or a slow connection.
- Works everywhere — any modern browser on Windows, macOS, Linux, Android or iOS.
- Part of a full developer tools suite, so related xml escape tasks are one click away.
Is it private and secure?
Your privacy is built in. XML Escape / Unescape runs completely on your device, so whatever you enter stays in your browser and is never transmitted, logged or stored on any server.
Network activity: none. Nothing is sent and nothing is fetched. This tool makes no network request at all once the page has loaded — which is why it keeps working if your connection drops.
You do not have to take that on trust — our privacy proof page publishes the Content-Security-Policy that enforces it, lists every third party it permits, and shows how to verify the whole claim yourself.
Learn more
Working with JSON, XML and YAML: Format, Validate and Convert — Messy config or API response? Learn to pretty-print, validate and convert between JSON, XML, YAML and CSV in seconds.
Frequently asked questions
Which characters must be escaped in XML?
Five: & becomes &, < becomes <, > becomes >, " becomes " and ' becomes '. Of these, & and < are mandatory everywhere in character data — the rest matter mainly inside attribute values.
When should I use CDATA instead of escaping?
When a block contains a lot of markup-like text — embedded HTML, a code sample, a regular expression. A CDATA section passes through unescaped and stays readable, but it cannot itself contain the sequence ]]>.
Why does my XML break on an ampersand?
Because a bare & starts an entity reference. A URL like ?a=1&b=2 placed directly into XML is malformed and every conformant parser will reject the document — it must be written &.
Is XML escaping the same as HTML escaping?
Close but not identical. HTML defines hundreds of named entities such as , while XML defines only those five; using in XML without declaring it is an error. XML is also stricter about well-formedness generally.
Related tools
See all free developer tools or browse the full tool catalogue.