Encoding

XML Entities Encode/Decode

Encode and decode XML entities — the 5 predefined ones (ampersand, angle brackets, apostrophe, quote) and numeric character references.

Unlike HTML, XML strictly requires escaping five special characters (&, <, >, ', "), or the document is considered invalid. This tool encodes and decodes those entities, as well as numeric character references.

How to use it

Common uses

Things to keep in mind

XML parsers are much stricter than HTML: a single unescaped entity invalidates the entire document, not just one element.

CDATA sections (<![CDATA[...]]>) are an alternative to escaping for large blocks of text, letting you insert arbitrary content without replacing every special character individually.

Article about this tool: XML Entities: escaping characters in XML documents

Frequently asked questions

What are the 5 predefined XML entities?

XML only predefines five named entities: &amp; (ampersand), &lt; and &gt; (angle brackets), &apos; (apostrophe), and &quot; (quote). Anything beyond these needs a numeric character reference instead.

How is this different from HTML entity encoding?

HTML defines a much larger set of named entities (like &nbsp; or &copy;), while strict XML only recognizes the five predefined ones — any other special character in XML must use a numeric reference like &#169; or &#xA9;.

When do I need to escape XML entities?

Escape characters like < > & ' " whenever they appear in text content or attribute values in an XML document, so the parser doesn't mistake them for markup and fail to parse the file.

What is CDATA and when should I use it instead of entities?

A <![CDATA[...]]> section lets you insert a block of text without escaping < and & — handy for large code or HTML fragments inside XML. The exception is the sequence ]]>, which closes CDATA and can't appear inside the section's own content.

Do all XML parsers handle invalid entities the same way?

No, and unlike browsers, which "forgive" mistakes in HTML, XML parsers are strict: a single unescaped ampersand or angle bracket makes the entire document invalid, and parsing stops with an error.

Articles: Encoding

Base64: why encoding is needed and how it works

How Base64 turns binary data into ASCII text and where that is actually needed.

Base32: how it differs from Base64 and when it is more convenient

The case-insensitive Base32 alphabet and scenarios where it beats Base64.

URL Encode/Decode: percent-encoding in links

How special characters in URLs and query parameters turn into %XX sequences.

HTML Entities: how to safely output special characters on a page

Why the characters &lt; &gt; &amp; need escaping and how that prevents broken markup.

JWT: token structure and what "decoding" a JWT actually means

The header, payload, and signature of a JWT, and why decoding is not the same as verifying the signature.

Unicode Escape: what \uXXXX sequences mean

Where \u0041-style sequences in JSON and JS strings come from and what they mean.

ROT13 and the Caesar cipher: simple character substitution

Why shifting by 13 letters makes ROT13 self-inverse, and why anyone still uses it today.

Punycode: how internationalized domains work in DNS

How a domain with non-Latin characters gets converted into an ASCII form with the xn-- prefix.

Morse code: how text becomes dots and dashes

The principle behind encoding letters as dots and dashes, and where Morse code is still used today.

Data URI: when to embed images directly in code

How a data: URI embeds a file’s contents directly in HTML or CSS, and when that is worth it.

Gzip + Base64: compressing data for text-based transfer

Why compressed binary data also gets Base64-encoded before going into a text field.