HTML Escape / Unescape - Encode HTML Entities Online
Escape and unescape HTML entities online. Convert &, <, >, ", ' to & < > " ' and back. Free, runs in your browser.
Input
Output
What Is HTML Escaping?
HTML escaping converts special characters into their HTML entity equivalents so they are displayed as text rather than interpreted as HTML markup. The five characters that must always be escaped are: & → &, < → <, > → >, " → ", and ' → '.
This tool has two modes: Escape and Unescape. Both run entirely in your browser; no data is sent to a server.
How to Use This Tool
Choose Mode
Select Escape to convert special characters to HTML entities, or Unescape to convert entities back to their original characters.
Paste or Upload Text
Paste your text or HTML into the left editor, or use Upload to load a file. Click Sample to try an example.
Copy or Download Result
The right panel updates automatically. Use <strong>Copy</strong> or <strong>Download</strong> to save the result. To format HTML, try the HTML Formatter tool.
HTML Escape Examples
Escaping converts special characters to HTML entities so they render as text:
Raw input (with special characters)
Escaped output (HTML entities)
When HTML Escaping Matters
When you display user-provided content in HTML, you must escape it first to prevent Cross-Site Scripting (XSS) attacks. An attacker could inject <script> tags or event handlers that execute arbitrary JavaScript. Escaping renders those characters harmless as text.
Unescaping is useful when you receive HTML-escaped content (e.g. from a database or API) and want to display or process the original text. See also HTML Unescape which starts in Unescape mode.
Frequently Asked Questions
What characters are escaped?
The five standard HTML entities: & → &, < → <, > → >, " → ", ' → '.
Is this the same as URL encoding?
No. HTML escaping uses named/numeric entities (&, <) for HTML contexts. URL encoding uses percent-encoding (%26, %3C) for URLs.
Why does & need to be escaped first?
Because & starts all HTML entities. If you escaped < first to <, then tried to escape &, you'd get &lt;. Always escape & first.
Is my data sent to a server?
No. All processing runs in your browser.
Can I escape a full HTML document?
Yes. Paste the entire HTML and the tool will escape all special characters. This is useful when you want to display HTML source code inside a web page.
Related Tools
The HTML Living Standard defines character references. MDN on HTML entities. The OWASP XSS guide explains why escaping matters for security.