HTML Escape / Unescape
Convert special characters like &, <, >, ", and ' into HTML entities (escape), or convert entities back to their original characters (unescape). Useful for XSS prevention and embedding text in HTML.
Common Named HTML Entities
| Character | Named Entity | Numeric Reference | Description |
|---|---|---|---|
| & | & | & | Ampersand (symbol for "and") |
| < | < | < | Less-than sign (same as the opening character of an HTML tag) |
| > | > | > | Greater-than sign (same as the closing character of an HTML tag) |
| " | " | " | Double quote (attribute value delimiter) |
| ' | ' | ' | Single quote (attribute value delimiter) |
| |   | Non-breaking space (a space that prevents line wrapping) | |
| © | © | © | Copyright symbol |
| ® | ® | ® | Registered trademark symbol |
| ™ | ™ | ™ | Trademark symbol |
| € | € | € | Euro sign |
| ¥ | ¥ | ¥ | Yen sign |
| ¢ | ¢ | ¢ | Cent sign |
What HTML escaping does
HTML escaping converts the five characters that carry special meaning in HTML — &, <, >, " and ' — into entity forms the browser will not read as markup. Embedding user input directly into a page without this can break the layout, because < and > are mistaken for the start and end of a tag, and can allow malicious code such as <script> to run — the vulnerability known as cross-site scripting, or XSS. Escaping is the basic defence against it.
Unescaping is the reverse: it turns named entities such as & and numeric references such as & back into the characters they stand for. It is what you want when you have copied HTML source from elsewhere, or when you are reading post data out of a CMS or forum and the entity form makes it hard to see the real text. The conversion runs entirely in the browser’s JavaScript, and what you type is never sent anywhere.
How to convert text
- Choose the direction Select escape to turn characters into entities, or unescape to turn entities back into characters.
- Paste your text into the input Put in the string you want to embed in HTML, or the string containing entity notation.
- Read the converted result The output below updates in real time as you type, and recalculates whenever you edit the input.
- Copy the result The copy button places the converted text on the clipboard, ready to paste into a CMS body or into source code.
Tips for getting more out of it
- HTML escaping is the foundation of XSS (cross-site scripting) prevention. Always escape user input before embedding it into HTML.
&must always be escaped first. If you convert other characters first, the&inside the newly generated&will get double-escaped.- When embedding a string inside an attribute value, it's safer to escape both
"(double quote) and'(single quote), not just one of them. - This tool can unescape decimal numeric references (
&), hexadecimal numeric references (&), and the major named entities (such as&). - Many template engines (Blade, JSX, Vue, etc.) automatically escape HTML when interpolating variables, but if you use a "raw HTML output" syntax like
{!! !!}or v-html, you'll need to escape the value yourself.
When escaping is useful
Quoting code in a CMS or blog post
Pasting a string containing < or > straight into an article body makes the browser read it as a tag and the display breaks. Escaping first lets it show safely.
Reading posts from a forum or comment thread
When posts sit in a database still in entity form, unescaping restores the original text and makes it readable.
Embedding HTML fragments inside Markdown
To show sample tags or code inside a Markdown document, escaping them first stops the Markdown parser and the browser from interpreting them as markup.
Debugging an HTML template
Useful for comparing before and after when you are working out where a template engine has escaped something unintentionally — or failed to escape it at all.
Terms used in HTML escaping
- HTML entity (character reference)
- A notation for displaying safely a character that carries special meaning in an HTML document. The named form begins with an ampersand and ends with a semicolon, as in
&. - Numeric character reference
- A notation giving a character by its Unicode code point. Decimal is written
&and hexadecimal&; both denote the same character. - Cross-site scripting (XSS)
- A vulnerability in which a script contained in user input is embedded in a page unescaped and then runs unintended code in another visitor’s browser. HTML escaping is the classic defence.
- Sanitising
- The general practice of removing dangerous elements from data received from outside, or converting it into a harmless form. HTML escaping is one kind of sanitising.
- Escaping the ampersand first
- The ampersand must be converted before anything else. Convert the other characters first and the ampersands inside the entities you have just produced, such as
&, get escaped a second time — which is why the order matters. - Attribute delimiters
- The double and single quotation marks that enclose an attribute value in an HTML tag. If such a character appears inside the value and is not escaped, it is mistaken for the end of the attribute.
Frequently Asked Questions
<, >, and & — are special because HTML parsers interpret them as part of the syntax itself. If you fail to escape them, the browser may mistake them for the start or end of a tag, which can lead to broken layouts or XSS (injection of malicious scripts).&, <, >, ", and '. Non-ASCII characters such as emoji and non-English text display safely as-is in modern UTF-8 environments, so no conversion is needed.
Side Note — The "Character Reference" Mechanism Inherited from SGML
The origin of HTML entities (character references) traces back to SGML (Standard Generalized Markup Language), the predecessor of HTML. SGML, standardized in 1986, already had a "character reference" mechanism for using the tag delimiter character < within body text. HTML inherited this mechanism almost unchanged, and basic named entities such as <, >, and & were already defined in HTML's earliest specifications during the 1990s.
Named entities were originally prized as a way to display special print symbols (such as the copyright symbol ©, the registered trademark symbol ®, and various Greek letters) in ASCII-only environments, before Unicode became widespread. The HTML5 specification ultimately defines over 2,000 named entities, covering even minor symbols like checkmarks and musical notes.
Today, the spread of UTF-8 encoding has greatly reduced the need for character references to avoid garbled text. However, three characters — <, >, and & — still require escaping for an entirely different reason. They carry special syntactic meaning to HTML parsers (the start of a tag, the end of a tag, and the start of an entity), so failing to escape them can directly lead to broken layouts or XSS vulnerabilities.