simple tools

HTML Escape & Unescape

HTML Entity Reference
& → &
< → &lt;
> → &gt;
" → &quot;
' → &#039;
/ → &#x2F;

Escaping: Converts special HTML characters (&, <, >, ", ', /) into HTML entities. This prevents HTML code from being executed and allows you to safely display code snippets in web pages.

About HTML Escape & Unescape

HTML escaping is the process of converting special characters into HTML entities to prevent them from being interpreted as HTML code. This is essential for displaying code examples, preventing XSS attacks, and safely handling user input. Common characters that need escaping include < (less than), > (greater than), & (ampersand), quotes, and apostrophes. This tool provides both escaping (characters to entities) and unescaping (entities to characters) with support for named entities (&lt;) and numeric entities (< or <). All processing happens in your browser for complete privacy.

How to Use

    Escape HTML Characters

  1. Select "Escape" mode (selected by default).
  2. Type or paste your text containing HTML characters.
  3. The tool will automatically escape special characters to HTML entities.
  4. Click "Copy" to copy the escaped text to your clipboard.
  5. Use the escaped text safely in HTML documents or databases.

    Unescape HTML Entities

  1. Select "Unescape" mode.
  2. Paste text containing HTML entities (&amp;lt;, &amp;gt;, etc.).
  3. The tool will automatically convert entities back to characters.
  4. Click "Copy" to copy the unescaped text to your clipboard.
  5. View the "HTML Entity Reference" dropdown for common conversions.

Frequently Asked Questions

What is HTML escaping?

HTML escaping is the process of converting special characters into HTML entities (like &lt; for < and &gt; for >). This prevents browsers from interpreting them as HTML tags and allows you to display HTML code as text on web pages.

Why do I need to escape HTML?

Escaping HTML is crucial for: 1) Displaying code examples on web pages, 2) Preventing XSS (Cross-Site Scripting) attacks by sanitizing user input, 3) Safely storing HTML content in databases, 4) Showing special characters without triggering HTML interpretation.

What characters are escaped?

This tool escapes: & (ampersand) to &amp;, < (less than) to &lt;, > (greater than) to &gt;, " (double quote) to &quot;, ' (single quote) to &#039;, and / (forward slash) to &#x2F;. These are the most common characters that need escaping for security and display purposes.

What is the difference between named and numeric entities?

Named entities use descriptive names (&amp;lt; for <, &amp;gt; for >). Numeric entities use character codes: decimal (&#60; for <) or hexadecimal (&#x3C; for <). Both represent the same character. Named entities are more readable, but numeric entities can represent any Unicode character.

Does this tool prevent XSS attacks?

HTML escaping is ONE part of XSS prevention. While escaping user input before displaying it helps prevent XSS, complete protection requires additional measures like Content Security Policy, input validation, and proper context-aware escaping. Never rely solely on escaping for security.

Can I escape other characters?

This tool focuses on the most critical HTML characters for security and display. Any character can be represented as a numeric HTML entity using its Unicode code point: &#[decimal]; or &#x[hex];. For example, © becomes &#169; or &#xA9;.

What is the difference between HTML encoding and URL encoding?

HTML encoding (escaping) converts characters to HTML entities for safe display in HTML. URL encoding converts characters to percent-encoded format for safe transmission in URLs. They serve different purposes: HTML encoding is for displaying content, URL encoding is for URL parameters.

Is my data secure?

Yes! All escaping and unescaping happens entirely in your browser using JavaScript. Your data is never sent to any server, ensuring complete privacy. The tool works offline once loaded.

Other Tools