HTML Escape / Unescape
Escape < > & " ' for safe HTML output or unescape entities back to text.
HTML Escape and Unescape Online
This HTML escape tool turns characters that have a special meaning in HTML into entity references, so a snippet of code or user-supplied text is displayed literally instead of being interpreted as markup. Switch to Unescape to turn <div> back into <div>. Everything runs locally in your browser.
Which characters are escaped
HTML only has five characters that can change how a document is parsed:
&→&– starts every entity, so it must be escaped first.<→<– would open a new tag.>→>– closes a tag; escaped for consistency."→"– ends a double-quoted attribute value.'→'– ends a single-quoted attribute value.
For example <a title="Tom's"> becomes <a title="Tom's">. Letters, digits, spaces, and line breaks are left alone, so indentation in your code is preserved.
Showing code snippets on a web page
When you write a tutorial or documentation page, the code inside <pre><code> must be escaped, otherwise the browser renders the tags instead of showing them and a stray && or < can swallow half the page. Paste the snippet here, copy the escaped output, and drop it between the tags.
Escaping and XSS prevention
Cross-site scripting happens when untrusted input such as <script>alert(1)</script> or <img src=x onerror=...> is written into a page unescaped. Escaping these five characters before output makes the browser treat the input as text. Remember that escaping depends on context: JavaScript strings, URLs, and CSS need their own encoding.
Options
- Also escape non-ASCII – additionally converts characters like
é,©, or€to named or numeric entities (é,©,€), useful for files saved in a legacy charset.
The unescaper decodes named, decimal, and hex references. For full entity control use HTML Encode / Decode or Text to HTML Entities.
Frequently Asked Questions
Which characters must be escaped in HTML?
Inside text content, & and < are the ones that really break markup; > is escaped for symmetry and safety. Inside attribute values you must also escape the quote character that delimits the attribute (" or '). This tool always escapes all five: & < > " and ', so the output is safe in both text and quoted attributes.
Does HTML escaping prevent XSS?
Escaping untrusted data before inserting it into HTML text or quoted attributes is the core defence against reflected and stored XSS. It is not enough for other contexts: values placed inside <script> blocks, event handlers (onclick), URLs (href="javascript:..."), or CSS need context-specific encoding or validation. Frameworks like React escape text automatically unless you use dangerouslySetInnerHTML.
Why is my text double-escaped, showing &lt; on the page?
The text was escaped twice – for example once by your code and again by a template engine. < escaped again becomes &lt;, which the browser shows literally as <. Escape exactly once, at the moment you write the value into HTML. Pasting double-escaped text into Unescape twice restores the original.
Why is the apostrophe written as ' and not '?
' was not part of HTML 4, so older browsers and some email clients do not understand it. The numeric reference ' works everywhere. The unescaper accepts ', ', and '.