HTML Escape / Unescape
Convert special characters like &, <, >, ", and ' into HTML entities (escape), or convert entities back to their original characters (unescape). Useful for XSS prevention and embedding text in HTML.
Common Named HTML Entities
| Character | Named Entity | Numeric Reference | Description |
|---|---|---|---|
| & | & | & | Ampersand (symbol for "and") |
| < | < | < | Less-than sign (same as the opening character of an HTML tag) |
| > | > | > | Greater-than sign (same as the closing character of an HTML tag) |
| " | " | " | Double quote (attribute value delimiter) |
| ' | ' | ' | Single quote (attribute value delimiter) |
| |   | Non-breaking space (a space that prevents line wrapping) | |
| © | © | © | Copyright symbol |
| ® | ® | ® | Registered trademark symbol |
| ™ | ™ | ™ | Trademark symbol |
| € | € | € | Euro sign |
| ¥ | ¥ | ¥ | Yen sign |
| ¢ | ¢ | ¢ | Cent sign |
Tips
- HTML escaping is the foundation of XSS (cross-site scripting) prevention. Always escape user input before embedding it into HTML.
&must always be escaped first. If you convert other characters first, the&inside the newly generated&will get double-escaped.- When embedding a string inside an attribute value, it's safer to escape both
"(double quote) and'(single quote), not just one of them. - This tool can unescape decimal numeric references (
&), hexadecimal numeric references (&), and the major named entities (such as&). - Many template engines (Blade, JSX, Vue, etc.) automatically escape HTML when interpolating variables, but if you use a "raw HTML output" syntax like
{!! !!}or v-html, you'll need to escape the value yourself.
Frequently Asked Questions
<, >, and & — are special because HTML parsers interpret them as part of the syntax itself. If you fail to escape them, the browser may mistake them for the start or end of a tag, which can lead to broken layouts or XSS (injection of malicious scripts).&, <, >, ", and '. Non-ASCII characters such as emoji and non-English text display safely as-is in modern UTF-8 environments, so no conversion is needed.
Side Note — The "Character Reference" Mechanism Inherited from SGML
The origin of HTML entities (character references) traces back to SGML (Standard Generalized Markup Language), the predecessor of HTML. SGML, standardized in 1986, already had a "character reference" mechanism for using the tag delimiter character < within body text. HTML inherited this mechanism almost unchanged, and basic named entities such as <, >, and & were already defined in HTML's earliest specifications during the 1990s.
Named entities were originally prized as a way to display special print symbols (such as the copyright symbol ©, the registered trademark symbol ®, and various Greek letters) in ASCII-only environments, before Unicode became widespread. The HTML5 specification ultimately defines over 2,000 named entities, covering even minor symbols like checkmarks and musical notes.
Today, the spread of UTF-8 encoding has greatly reduced the need for character references to avoid garbled text. However, three characters — <, >, and & — still require escaping for an entirely different reason. They carry special syntactic meaning to HTML parsers (the start of a tag, the end of a tag, and the start of an entity), so failing to escape them can directly lead to broken layouts or XSS vulnerabilities.