Escape XML
Escape &, <, >, quotes, and apostrophes so text is safe to embed inside XML.
XML defines five reserved characters that must be escaped wherever they appear as literal text — &, <, >, ", and ' — or the document won't parse. This converts all five to their entity form in one pass, ready to embed inside an element or attribute value.
Example: Tom & Jerry's "Show" <Live> escapes to Tom & Jerry's "Show" <Live> — safe to embed as literal text inside an XML element or attribute.
How it works
- Paste text to embed inside an XML document
- The five XML-reserved characters are converted to entities, instantly on your device
- Copy the escaped result into your XML
Frequently asked questions
Why does XML escape apostrophes differently than HTML?
XML's spec defines ' as one of its five built-in entities, while HTML historically didn't (older HTML parsers didn't reliably support '), so HTML tooling conventionally uses the numeric ' instead — both represent the same character.
Is my data uploaded anywhere?
No — Escape XML runs entirely in your browser using JavaScript/WebAssembly. Your data is never sent to a server.
Do I still need to escape text inside a CDATA section?
No — a CDATA section tells the XML parser to treat its contents as raw literal text, so none of the five reserved characters need escaping there. This tool is for text going directly into normal element or attribute content.