XML Entity Escape / Unescape
Escape & < > " ' for safe XML, or decode named, decimal and hexadecimal references back to characters.
What is Entity Escape?
An XML escaping tool. It writes the five predefined entities and can restore any named, decimal or hexadecimal character reference — including the HTML-style names that are common in the wild but are not part of XML.
How it works
Escaping handles text and attribute contexts separately, because a quote is only special inside a quoted attribute value and an apostrophe only inside a single-quoted one; escaping everything everywhere produces correct but noisy output. Unescaping decodes numeric references, reports unknown named ones with the exact text that failed, and rejects references outside the character range XML permits.
- Paste the document. Drop in XML, a schema, a feed or an XPath expression. Everything is parsed in the page: no upload, no server round trip, and the tools keep working with the network switched off.
- Set the options that match your document. Indent unit, whether to keep comments, which dialect, which output method. The defaults are the safe ones — nothing that changes meaning is enabled for you.
- Read the result, then copy or download it. Results appear as you type, copy straight to the clipboard, and download with a sensible filename (.xml, .xsd, .csv). Reset returns every field to its default.
Examples
A minified document from an API response
Paste one line of XML and the Formatter indents it, wraps long start tags one attribute per line and normalises empty elements — without touching text inside mixed content.
An XPath that works in Chrome and not in your servlet
The XPath Tester evaluates against a real tree and reports the axis or function it cannot support, instead of returning zero nodes and letting you guess why.
A document that will not parse
The Validator gives line and column for every mismatched tag, stray ampersand and duplicate attribute, with the reason in words: which open element was expected, which was found.
A schema that only half matches your data
The XSD Validator marks each violation with the path of the offending node, and the Schema Generator goes the other way — inferring a starting-point XSD from real documents.
Common mistakes
Assuming a pretty-printer cannot change meaning
Whitespace between elements is often insignificant, but inside mixed content it is not: `<p>Hello <b>world</b></p>` must stay on one line. Formatting here re-indents element-only content and leaves mixed content alone.
Treating a validation pass as proof of interoperability
The DTD and XSD validators implement honest subsets. A document reported valid here can still be rejected by a full validator that understands identity constraints, substitution groups or XSD 1.1 assertions — each page lists what it does not cover.
Reading the whole document because the parser did
A DOCTYPE is not inert. If your parser resolves external entities, pasting an untrusted document is enough to read a file or call an internal URL. The XXE Risk Checker shows what a document asks for; the fix is in the parser configuration.
Forgetting that attributes and elements are not interchangeable
`<id>1</id>` and `id="1"` mean different things to every schema and every XPath. When converting to CSV or YAML the distinction is preserved (`@id`), because flattening it away is the change that costs an afternoon later.
Frequently asked questions
Why did not decode?
Because XML does not define it. The named entities XML knows are only & < > " and ', plus whatever a DTD declares. Tools like this one decode the familiar HTML names as a convenience, but a strict XML parser will reject ` ` in a document with no DTD — use  .
Is escaping the same as sanitising?
No. Escaping makes text safe for an XML position, which prevents markup injection when you build a document. It does nothing about what the text contains, and no escaping rule can fix a document assembled by string concatenation around untrusted input — use a real writer for that.
Should I escape quotes in text content?
Not necessary, and it makes the output harder to read. Quotes only terminate a value inside an attribute. The tool's text mode escapes the three characters that must be escaped in text and leaves quotes alone; the attribute mode escapes whichever quote delimits the value.