HTML Escape Unescape
Escape HTML-sensitive characters or decode HTML character references for code samples, CMS content, templates, API debugging, and frontend work.
Paste raw text or markup to escape, or paste character-reference text to decode. The conversion runs in this browser tab.
Conversion Settings
Options
Escape mode targets &, <, >, double quotes, and apostrophes. Ordinary Unicode text is left alone.
What stays local—and what escaping cannot protect
The pasted value is transformed by client-side JavaScript; no application-server request is made with that value. HTML escaping only protects the HTML context it was designed for. URL components, JavaScript, CSS, and intentionally rendered HTML each need their own handling.
What HTML Escaping Actually Changes
HTML character references let source text represent characters that otherwise have a special role in HTML syntax. The two references most commonly needed in normal HTML text are < for a literal less-than sign and & for a literal ampersand. Quotes become especially important when a value is placed inside a quoted HTML attribute.
Replacing every non-ASCII character is usually unnecessary. With a correctly declared UTF-8 document, characters such as ©, é, ₹, or emoji can normally remain as literal Unicode text. Character references earn their place when a character is syntactically significant, difficult to type, or required by the surrounding format.
Named vs Numeric Character References
| Character | Named output | Numeric output | Why it matters |
|---|---|---|---|
| & | & | & | Starts character-reference syntax. |
| < | < | < | Can start an HTML tag or markup construct. |
| > | > | > | Often encoded for symmetry; it is less frequently required in plain text. |
| " | " | " | Important inside double-quoted attribute values. |
| ' | ' | ' | Important inside single-quoted attribute values. |
Named mode emits the HTML named references for these five characters, including '. Numeric mode uses decimal references. Decode mode accepts the much larger set of browser-recognized named and numeric references.
HTML Context Matters More Than the Word “Escape”
HTML text between tags
Encoding & and < prevents text from being interpreted as character-reference syntax or markup. Encoding > is commonly harmless but is not universally required in ordinary text.
Quoted HTML attributes
Keep the attribute value quoted and encode the quote character that delimits it. A generic five-character encoder is helpful for inspection, but application code should use a framework or encoder designed for the exact output context.
JavaScript, CSS, and URLs
HTML entity encoding is not the correct general-purpose encoding for inline JavaScript, CSS values, or URL components. Those parsers have different escaping rules.
HTML that must remain markup
If users are intentionally allowed to submit formatted HTML, escaping will make the tags visible as text. That case needs an HTML sanitizer and a carefully controlled rendering path instead.
Double Encoding and Single-Pass Decoding
A common production bug is escaping text that has already been escaped. For example, escaping < produces &lt;. A browser then displays < instead of the intended <. The fix is usually to identify the correct encoding boundary rather than repeatedly decoding until the text “looks right.”
Raw text: <strong>Hi</strong> Escaped once: <strong>Hi</strong> Escaped twice: &lt;strong&gt;Hi&lt;/strong&gt; Decode one pass: <strong>Hi</strong>
What Unescape Mode Uses
Unescape mode asks the browser's HTML parser to interpret character references and returns the resulting text. That means it can decode decimal references such as ©, hexadecimal references such as ©, and recognized named references such as ©.
HTML also retains some legacy named references that browsers accept without a semicolon in limited situations. Do not treat successful decoding as proof that the original source used the clearest or most portable syntax. When you generate HTML yourself, prefer complete references with their terminating semicolon.
Where HTML escaping usually goes wrong
- Escaping too early: data is encoded in storage and then encoded again by the rendering layer.
- Escaping for the wrong parser: HTML encoding is applied to data that will actually be inserted into JavaScript, CSS, or a URL component.
- Turning sanitization into encoding: rich HTML is escaped, which prevents XSS but also destroys the intended formatting.
- Turning encoding into sanitization: untrusted HTML is decoded and then inserted with an unsafe HTML sink because the text “looked encoded.”
- Changing whitespace unintentionally: enable the trim option only when leading and trailing whitespace are not significant to the target format.
The browser rules behind the references
The exact character-reference grammar and the browser's longest-match parsing behavior come from the WHATWG HTML syntax and its named-character-reference table. When the question is security rather than syntax, OWASP's XSS Prevention Cheat Sheet is the better reference because it separates HTML text, attributes, JavaScript, CSS, URL contexts, sanitization, and unsafe sinks.