HTML Escape
Escape HTML entities
Escape or unescape HTML entities.
Input
Output (Escaped)
About the HTML Escape
Characters like < and & have special meaning in HTML. To show them as text, for example in a code sample or in text a user typed, they have to be written as entities. This tool escapes text into HTML entities and unescapes entities back into plain text.
What gets escaped
- & becomes & and must go first, so the other entities are not double-escaped.
- < becomes < and > becomes >, so tags show as text instead of being parsed.
- " becomes " and ' becomes ', so values are safe inside HTML attributes.
Example
<a href="/">Home</a> & more
// escapes to
<a href="/">Home</a> & moreUnescaping
Flip the switch to Unescape to turn entities back into characters. Your browser does the decoding, so every named entity works, such as © and , along with numeric ones like € for the euro sign.
Escaping and security
Escaping is the standard defence against cross-site scripting (XSS) when untrusted text goes into a page: an escaped script tag is displayed, not run. Frameworks like React escape text for you, so this tool is for HTML written by hand, such as templates, emails, documentation, and CMS fields.