XML Unescape
Turn XML entities and numeric character references back into readable plain text.
Escaped XML
Plain text
Escaped XML shows up wherever a document has been embedded inside another: log files, database columns, JSON string fields, and error messages that quote a payload back at you. This tool reverses the encoding so you can read what the text actually says.
The five predefined entities are decoded, along with decimal (—) and hexadecimal (✓) character references. Ampersands are decoded last, which prevents the classic double-decoding bug where &lt; incorrectly collapses all the way to <.
How to use the xml unescape
- 1
Paste the escaped text
Anything containing XML entities or numeric character references.
- 2
Unescape
Entities are decoded in the correct order to avoid double-decoding.
- 3
Format the result if it is a document
If what emerges is itself XML, send it to the XML formatter to make the structure readable.
Why decoding order matters
Decoding & first would turn &lt; into <, and a second pass would then turn that into < — losing the fact that the original text contained a literal < string. Decoding ampersands last preserves the distinction, which matters whenever content has been escaped more than once as it moved between systems.
Custom entities are not supported
Documents can declare their own entities in an internal DTD subset. Those are specific to the document that defines them, so a standalone unescaper cannot resolve them. Only the five predefined XML entities and numeric character references are decoded here.
XML Unescape FAQ
Why is my text still escaped after running this?
It was probably escaped twice as it passed between systems. Run the tool a second time on the output to peel off the next layer.
Does it handle HTML entities like ?
No. HTML defines hundreds of named entities; XML defines exactly five. Numeric references such as work in both and are decoded here.
What happens to custom entities declared in a DTD?
They are left untouched. A document can declare its own entities in an internal DTD subset, and those definitions live inside the document itself — a standalone unescaper has no way to resolve them without parsing that DTD.
The result is XML. Can I format it here?
Not on this page — send the decoded output to the XML formatter, which will indent it and confirm it is well-formed.