Escape text for XML, which predefines only amp, lt, gt, quot and apos – everything else must be a numeric reference. Control characters that XML 1.0 forbids are escaped too.
Show calculation steps
Processed privately in your browser — nothing you paste is uploaded, logged or stored.
The five that matter
XML predefines exactly five entities: < > & " and '. Unlike HTML, which has thousands of named entities, XML has these and nothing more unless a document declares its own — which is why HTML entities pasted into XML cause parse errors.
Worked example
Tom & Jerry <3 → Tom & Jerry <3 is NOT valid XML unless declared
Attributes versus text
Inside element text you must escape & and <. Inside an attribute you must additionally escape whichever quote character delimits it. Escaping all five everywhere is always safe and is what this produces.
Why it matters more in XML
HTML parsers are famously forgiving; XML parsers are specified to stop at the first error. A single unescaped ampersand makes an entire document unparseable, which is why feeds and configuration files break completely rather than partially.
Limits
This escapes text for XML; it does not build or validate a document. Encoding is done in your browser.
How to use the XML Entity Encoder
- Paste the text that needs to go inside an XML document.
- Keep attribute mode on when the text will sit inside an attribute value, so quotes are escaped too.
- Enable the non-ASCII option if the document may not reliably declare its encoding.
- Click "Encode for XML".
Frequently asked questions
Why does XML have only five named entities?
XML is deliberately minimal: amp, lt, gt, quot and apos are the only names defined by the specification. Everything else must either be a numeric character reference or be declared in a document type definition. HTML, by contrast, predefines hundreds of names.
Why are some invisible characters escaped automatically?
XML 1.0 forbids most control characters from appearing literally in a document, even though they are valid Unicode. Encoding them as numeric references keeps the document well-formed. This is a common source of parser errors when exporting data from databases.
Do I need to escape the greater-than sign?
Strictly it is only required in the specific sequence that ends a CDATA section, but escaping it always is the safer habit and costs nothing – so this tool escapes it consistently.
