Free HTML Escape / Unescape Online
Escape and unescape HTML entities online — convert special characters to safe entities instantly.
Input
Output
What Is HTML Escaping?
You're building a page that displays user comments, and someone submits <script>alert(1)</script>. If you render that without escaping, congratulations — you just shipped an XSS vulnerability. HTML escaping converts the five dangerous characters (&, <, >, ", ') into their safe entity equivalents as defined in the HTML Living Standard. The MDN entity reference has the full list. For URL contexts, use encodeURIComponent instead — HTML escaping and URL encoding are different beasts.
There are two modes, Escape and Unescape, and either way the characters are swapped by JavaScript in this tab without a round trip to any server.
How to Use This Tool
Choose Mode
Select Escape to convert special characters to HTML entities, or Unescape when you have <-style entities that should turn back into the characters they stand for.
Paste or Upload Text
Paste the text or markup on the left, or bring it in from a file with Upload. Sample gives you a snippet full of angle brackets and ampersands to try both modes on.
Copy or Download Result
The right panel updates automatically. Use Copy or Download to save the result. To format HTML, try the HTML Formatter tool.
HTML Escape Examples
Escaping converts special characters to HTML entities so they render as text:
Raw input (with special characters)
Escaped output (HTML entities)
When HTML Escaping Matters
When you display user-provided content in HTML, you must escape it first to prevent Cross-Site Scripting (XSS) attacks. An attacker could inject <script> tags or event handlers that execute arbitrary JavaScript. Escaping renders those characters harmless as text.
Unescaping is useful when you receive HTML-escaped content (e.g. from a database or API) and want to display or process the original text. See also HTML Unescape which starts in Unescape mode.
Frequently Asked Questions
What characters does the HTML escape tool convert?
The five characters that must be escaped in HTML: & → &, < → <, > → >, " → ", ' → '. These are defined in the HTML Living Standard.
Does HTML escaping do the same job as URL encoding?
No. HTML escaping uses named/numeric entities (&, <) for HTML contexts. URL encoding uses percent-encoding (%26, %3C) for URLs. See MDN encodeURIComponent for URL encoding.
Why does the ampersand need to be escaped first?
Because & starts all HTML entities. If you escaped < first to <, then escaped &, you'd get &lt; — double-encoded. Always escape & first.
Does the text I escape get uploaded?
No. Swapping characters for entities (and back) is done by JavaScript on this page, so the snippet stays on your computer.
How does HTML escaping prevent XSS attacks?
By converting < and > to entities, any injected <script> tags become harmless text instead of executable code. The OWASP XSS guide recommends escaping as a primary defense.
Related Tools
The HTML Living Standard defines character references. MDN on HTML entities. The OWASP XSS guide explains why escaping matters for security.