HTML Escape / Unescape
Escape HTML special characters so code displays safely, or turn entities back into text.
Processed locally
Escaping turns < into < so browsers show code instead of running it.
Instructions
How to use it
- 01Choose Escape or Unescape.
- 02Paste your HTML or text. The result updates instantly.
- 03Adjust the options, then copy the output.
About
What it does
In HTML, characters like <, > and & have special meaning. To show them as text (for example, code samples in a blog post), they have to be written as entities: <, >, &.
Escaping also matters for security: inserting unescaped user input into a page is how cross-site scripting (XSS) happens. This tool escapes text for safe display, or turns entity-filled text back into readable characters.
Settings explained
- Escape quotes
- Converts " and ' too. Required when the text goes inside an HTML attribute value.
- Escape non-ASCII
- Writes characters like é and emoji as numeric entities (é), useful for systems that mangle UTF-8.
- Unescape
- Decodes named entities (©), decimal (©) and hex (©). Unknown entities are listed and left untouched.
Good for
- Showing HTML code samples in a blog post or documentation
- Cleaning up text scraped from a web page full of & and '
- Preparing strings for HTML attributes and templates
- Checking how a CMS stored special characters
Questions, answered
- Is escaping enough to prevent XSS?
- Escaping is the right defence when inserting text into HTML content or quoted attributes. Other contexts (JavaScript, CSS, URLs) need their own escaping, so use a framework that handles context automatically.
- What's the difference between ' and '?
- Both mean an apostrophe. ' works everywhere; ' isn't defined in older HTML versions, so escaping uses '.
- Why are some entities left unchanged?
- They're either misspelled or not standard. The tool lists them so you can check rather than silently guessing.
Related tools
All encoding tools (3)- URL Encoder / DecoderPercent-encode text for URLs or decode it back, including emoji and non-Latin scripts.
- Base64 Encoder / DecoderEncode text to Base64 or decode it back, with full Unicode and URL-safe support.
- Markdown Editor & PreviewWrite Markdown with a live preview and formatting shortcuts. Export as HTML or .md.
- XML Formatter & ValidatorFormat, minify and check XML for well-formedness, with errors that point to the exact line.