HTML Escape

What is HTML escaping?

HTML escaping (also called entity encoding) is the process of replacing characters that have special meaning in HTML — namely &, <, >, " and ' — with their corresponding character entity references. For example, the less-than sign < becomes <, and the ampersand & becomes &. Escaping is what allows those characters to be displayed as literal text on a web page instead of being interpreted as HTML markup.

The HTML specification defines named entities such as &, <, >, " and ', as well as numeric character references like < for the same characters. Escaping is essential whenever user-generated content, code snippets, or data containing angle brackets is inserted into an HTML document, because an unescaped < could start an unwanted tag and break the page layout or introduce an XSS vulnerability.

When to escape HTML

HTML escaping is required whenever text that may contain special characters is inserted into an HTML context. Common scenarios include:

• Displaying code snippets. Showing <div> as literal text on a tutorial page requires escaping the angle brackets.
• User-generated content. Comments, forum posts and chat messages must be escaped before rendering to prevent XSS attacks.
• Template rendering. Server-side and client-side template engines escape interpolated values by default to keep output safe.
• JSON in HTML. Embedding JSON inside a <script> tag requires escaping </ to avoid premature script termination.
• Attributes. Values placed inside class="…" or data-* attributes must escape quotes to stay valid.
• Email templates. HTML emails must escape ampersands in URLs and tracking parameters for maximum client compatibility.

Forgetting to escape is one of the most common causes of cross-site scripting (XSS) vulnerabilities, so escaping should be the default and unescaping the exception.

Escape vs unescape

Escaping converts raw characters into entity references, while unescaping (decoding) reverses the process. This tool supports both directions through a mode selector. When you choose "Escape", & becomes & and < becomes <. When you choose "Unescape", the entity references are converted back to their original characters.

Note that the ampersand must always be escaped first (or unescaped last) to avoid double-encoding. This tool follows that order automatically. The five characters handled are: & → &, < → <, > → >, " → ", and ' → '.

Common HTML entities

The table below lists the entities most frequently encountered in everyday HTML work.

Character	Entity	Notes
&	&	Must be escaped first; starts all entities
<	&lt;	Starts a tag; escape in text content
>	&gt;	Ends a tag; escape in text content
"	&quot;	Escapes inside double-quoted attributes
'	&#39;	Escapes inside single-quoted attributes
non-breaking space	&nbsp;	Prevents line break and collapsing
©	&copy;	Copyright symbol
→	&rarr;	Right arrow

Numeric references such as ’ (right single quote) and … (horizontal ellipsis) are also valid and are often emitted by rich-text editors.

How to escape or unescape HTML

Processing text with this tool takes only a second and happens entirely inside your browser. No upload, no sign-up, and no installation are required. Follow these steps:

1. Choose a mode. Select "Escape" to encode special characters into entities, or "Unescape" to decode entities back to characters.
2. Paste your text. Type or paste the HTML or text you want to convert into the input box.
3. Click "Process". The tool applies the selected transformation and writes the result into the output box in real time.
4. Copy the result. Click "Copy to Clipboard" to copy the converted text, then paste it into your HTML, template or code.

Because every step runs locally in your browser using JavaScript, your text is never uploaded to a server. This makes the conversion completely private, fast, and suitable for sensitive content such as user data, tokens and source code.