HTML Escape / Unescape
Escape HTML special characters (&, <, >, ", ') to their entity equivalents, or unescape them back to readable text. Essential for inserting user-generated content safely into HTML.
Escape special HTML characters into entities or convert escaped HTML entities back to text. The escape action handles ampersands, angle brackets, double quotes, and single quotes, while unescape uses the browser HTML parser to decode entities locally.
How to escape or unescape HTML
- Paste the text or escaped HTML into the input area.
- Choose Escape to replace special characters with HTML entities, or Unescape to decode entities back to text.
- Review the converted result and character count.
- Copy the output when you are ready to use it in code, documentation, or text.
What HTML escaping changes
Escaping converts characters that have special meaning in HTML into entity forms such as &lt; for < and &amp; for &. This is useful when you want markup characters to appear as literal text instead of being interpreted as HTML syntax.
This tool performs character escaping and decoding only. It is not a complete HTML sanitizer and does not decide whether arbitrary markup is safe to render. Security-sensitive applications should use context-aware escaping or a trusted sanitizer appropriate for the exact output context.
Privacy and limitations
Conversion happens entirely in your browser and no input upload is required. Unescape relies on the browser DOM parser, so named and numeric entities supported by the browser can be decoded. The result should still be treated as ordinary text unless your application intentionally and safely parses it as markup.
Frequently asked questions
Which characters are escaped?
The escape action converts &, <, >, double quotes, and single quotes.
Is HTML escaping the same as sanitizing HTML?
No. Escaping turns special characters into text entities, while sanitizing decides which markup is safe to allow.
Can numeric HTML entities be decoded?
The browser parser can decode standard named and numeric entities it recognizes.
Why would I escape HTML?
It is useful when markup characters need to be displayed or stored as literal text instead of interpreted as HTML.
Is my input sent to a server?
No. Escaping and decoding run locally in the browser.