HTML Escape / Unescape
Convert < > & quotes into HTML entities — and entities back into characters.
Free · No sign-up · Runs locally in your browser · Also available in Chinese (中文)
What is HTML Escape / Unescape?
HTML escaping replaces characters that have structural meaning in HTML — <, >, &, " and ' — with their entity equivalents (<, >, &...). This is what makes it safe to display user-generated content, code samples and JSON inside a web page without the browser interpreting them as markup or executing scripts.
The tool works in both directions and also handles named entities beyond the basic five, such as © and . Unescape is equally important when you need to recover readable text from content that arrives pre-escaped from an API or CMS.
How to use it
- 1Paste the text or HTML snippet into the input area.
- 2Choose Escape (text → entities) or Unescape (entities → text).
- 3The converted result appears instantly in the output panel.
- 4Copy it back into your template, code or content field.
Common use cases
- Safely embedding a code snippet inside a blog post or documentation page.
- Escaping user input before inserting it into HTML to prevent XSS.
- Decoding entity-laden text from an API into readable content.
Frequently asked questions
▸Is escaping the same as sanitization?
No. Escaping makes characters display literally; sanitization removes dangerous constructs. Escaping at output time is the primary defense for XSS; sanitization is for when you must accept a controlled subset of HTML as input.
▸Why does & need escaping first?
& introduces every entity. If you escape < first but & last, you can accidentally double-encode (&lt;). This tool escapes in the correct order so one pass is always safe.