Home/HTML Escape / Unescape
Text

HTML Escape / Unescape

Escape and unescape HTML special characters

Input
Plain text
Lines: 0Chars: 0
Output
Escaped
Lines: 0Chars: 0

Overview: HTML Escape / Unescape escapes special characters <, >, &, ", ' into their corresponding HTML entities (such as &lt;), and reverses the operation. Escaping prevents HTML parsing errors and blocks XSS attacks, and is one of the most fundamental security practices in web development.

How to use: Step 1 — paste the original text (which contains HTML special characters or tags) on the left, or click Sample to load an example. Step 2 — the escaped result appears on the right in real time; each special character is replaced by an &xxx; entity. Step 3 — for the reverse direction, paste an entity-containing string on the right and the tool restores the original characters (supporting &nbsp;, &#39;, &#x27; and other common encodings). Step 4 — copy or download the result.

Typical scenarios: Back-end developers escape user input before writing to the database to prevent XSS; embed code samples inside <pre><code> on a technical blog; debug entity-encoded rich text in API responses; process content stored by a CMS rich-text editor; parse HTML data captured by a scraper.

Technical notes: Escape mappings: & → &amp; (processed first), < → &lt;, > → &gt;, " → &quot;, ' → &#39;. Unescape additionally supports &nbsp; (space) and &#x27; (hex single quote). Generic decimal or hex numeric references (such as &#8226;) are not supported — combine with DOMParser for full coverage. Escaping only protects HTML context; use a separate escape for JavaScript-string context.

Privacy: All escaping happens locally in your browser and no content is uploaded, so it is safe to use with user-submitted form data or comment content.

Frequently Asked Questions

How do I use HTML Escape / Unescape?
Step 2 — the escaped result appears on the right in real time; each special character is replaced by an &xxx; entity. Step 3 — for the reverse direction, paste an entity-containing string on the right and the tool restores the original characters (supporting , ' , &#x27; and other common encodings).
What can HTML Escape / Unescape do?
Typical scenarios: Back-end developers escape user input before writing to the database to prevent XSS; embed code samples inside <pre><code> on a technical blog; debug entity-encoded rich text in API responses; process content stored by…
Is my data private when I use HTML Escape / Unescape?
Privacy: All escaping happens locally in your browser and no content is uploaded, so it is safe to use with user-submitted form data or comment content. Privacy: All escaping happens locally in your browser and no content is uploaded, so it is safe to use with user-submitted form data or comment content.
What technical details should I know about HTML Escape / Unescape?
Unescape additionally supports (space) and &#x27; (hex single quote). Generic decimal or hex numeric references (such as &#8226; ) are not supported — combine with DOMParser for full coverage.