XML entity encoder
Escapes the five characters XML reserves, so “Tom & Jerry <3” becomes “Tom & Jerry <3”, and turns &, <, >, ' and " back into plain characters. Unknown names are refused instead of slipping through. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Text
- Tom & Jerry <3
- Calculation mode
- Encode
- Result
- Tom & Jerry <3
- Encoding
- xml_entities
- Input length
- 14
- Output length
- 21
This XML entity encoder converts the five special characters that XML reserves for markup structure into their predefined named entities, and it reverses the same mapping when you paste entity-escaped text back into plain characters. Encoding rewrites ampersand, less-than, greater-than, apostrophe, and double quote so element content and attribute values stay safe without breaking tags or attribute delimiters. Decoding accepts only the five predefined forms &, <, >, ', and ", and it fails loudly on unknown names, numeric character references, or incomplete entity stubs so typos never silently survive into production XML. The path is fully deterministic: the same text and mode always produce the same result, with no network calls, no random salts, and no date-dependent shortcuts. Small checks include encoding Tom & Jerry into Tom & Jerry and decoding <tag> back to angle brackets.
What the five predefined XML entities are and what this tool returns
XML defines exactly five predefined character entities that every conforming processor must recognize without a DTD declaration. Ampersand starts a character or entity reference, so a literal ampersand in text or attributes must be written as & if you intend the glyph rather than the start of another reference. Less-than and greater-than open and close tags, so they become < and > when you want those symbols as data.
Apostrophe and double quote commonly delimit attribute values, so they become ' and " when they appear inside quoted attributes of the same style. This page implements that classic encode set on the encode path and the reverse on decode: only those five named forms are rewritten. Unlike a general HTML entities tool, this landing does not accept , ©, or hundreds of other HTML names, and it does not expand decimal &#N; or hexadecimal &#xH; numeric character references.
That narrow contract matches authors who need strict XML predefined-entity hygiene rather than a full HTML named-entity table.
Where XML entity encode and decode fit in markup workflows
Frontend and backend teams encode dynamic titles and labels before placing them inside element content or quoted attributes so a single ampersand or angle bracket cannot break the surrounding markup. Pipeline authors decode entity-heavy exports from legacy systems so application code works with true quotes and ampersands instead of literal & sequences. Quality engineers generate deterministic encode and decode pairs for contract tests so a middleware that claims XML entity support cannot silently switch to HTML-only names or numeric references between releases.
Educators use the same tool when teaching the difference between the five predefined XML entities, HTML named entities, and numeric character references that some HTML parsers accept more loosely.
What you can do with it
Safe XML element and attribute text
Encode titles, labels, and user snippets so ampersands, quotes, and angle brackets cannot break tags or attributes in well-formed XML.
Legacy feed and config cleanup
Decode the five predefined XML entities from exported feeds, configs, or database fields back into plain Unicode for modern processors.
FAQ
What does the XML entity encoder cost?
It is free in your browser on this page.
Which characters are encoded?
Encode mode rewrites &, <, >, ', and " into &, <, >, ', and ". Other characters are left unchanged.
What happens if an entity is unknown or numeric?
Only &, <, >, ', and " are accepted; HTML names and &#N; / &#xH; forms are rejected.
Is the result deterministic?
Yes. The same text and mode always produce the same result with no network, randomness, or date-dependent behavior.
Why do I get &lt; when I encode text twice?
Encoding rewrites every ampersand, including the one that starts an entity you already wrote. Feed escaped text through encode again and < turns into &lt;, so encode plain text once and use decode to go back.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/xml-entities \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"Tom & Jerry <3"}'const res = await fetch("https://api.kit.forhosting.com/enc/xml-entities", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "Tom & Jerry <3"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/xml-entities",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "Tom & Jerry <3"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/xml-entities", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"Tom & Jerry <3"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"Tom & Jerry <3"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/xml-entities", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "Tom & Jerry <3"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.xml_entities",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
Use it free in the browser for config hygiene and content cleanup, or call the API at $0.002 per successful request when pipelines need reproducible XML entity transforms in CI and backend services.
What the five predefined XML entities are and what this tool returns
The JSON response always includes result for the transformed string, mode echoing encode or decode, encoding fixed to xml_entities, and input_length plus output_length so tests can assert sizes. Encode also reports entities_encoded and decode reports entities_decoded so you can confirm how many special characters or named references were rewritten. There is no partial silent skip for unknown complete entities: either every complete &name; is one of the five predefined forms or the request fails with invalid_input.
How text and mode are read and how results stay reproducible
Encode walks the string character by character and replaces only the five special characters with their preferred entity forms, leaving letters, digits, and other Unicode unchanged so readable copy stays readable. Because ampersand is rewritten in the same left-to-right pass as the other specials, you never double-encode an already escaped fragment in a second accidental pass unless you feed entity text back into encode again. Decode scans for well-formed &name; sequences: a letter-started name of letters and digits ending with a semicolon. Numeric forms such as ' and ' are also rejected because they are not among the five predefined named entities this tool implements. Incomplete stubs that start an entity-like sequence without a terminating semicolon fail closed. The preferred payload field is text, with aliases input, value, s, and xml so forms, query strings, and SDK clients can reuse the same contract without renaming columns. Mode defaults to encode and accepts decode explicitly; aliases op, direction, and action map to the same switch for scripts that already use those names, and escape or unescape are accepted as synonyms. Bare ampersands that do not form a complete reference are left untouched so incomplete drafts do not explode, but a complete unknown name such as or ¬anentity; raises invalid_input with a message that names the bad reference. The length ceiling of one hundred thousand characters keeps Worker memory predictable while still covering templates, sample documents, and most paste buffers. Pair the free browser run on this page with the priced API when you need the identical mapping inside an automated pipeline without re-implementing XML entity tables yourself. Invalid inputs return invalid_input and are not charged, which keeps validation cheap while successful transforms remain a fixed item price at $0.002.
Where XML entity encode and decode fit in markup workflows
Developers meet the five predefined XML entities when they embed user text into configuration files, SOAP or REST XML payloads, SVG attributes, RSS and Atom feeds, and any document that must stay well-formed under a strict XML parser. On this page the work runs entirely in your browser; through the API each successful lookup costs $0.002, failed validation is not charged, and nothing is stored after the response returns. That split—free interactive exploration and a priced, identical API—matches the rest of the KIT tier-A catalog and lets you move from a classroom demo to an automated pipeline without changing the encoded result. Pair it with XML-to-JSON or HTML entity helpers when you need broader markup conversion, and with other encoding endpoints when you are building a small lab of free, deterministic text tools for CI and documentation.
Integration use cases
Deterministic CI fixtures
Generate reproducible encode and decode pairs for unit tests, golden files, and contract checks across services that emit XML.
Technical questions
What modes are supported?
mode=encode (default) turns the five special characters into entities. mode=decode turns only the five predefined named entities back into characters.