HTML escape / unescape
Convert special characters into safe HTML entities or decode existing entities back into readable text in a simple browser-based workspace.
About this tool
Escape HTML special characters to entities (< & "), or unescape entities back to readable text. Runs in your browser — no signup, no install.
Convert special characters into safe HTML entities or decode existing entities back into readable text in a simple browser-based workspace.
- 1
Paste your text or HTML into the input field.
- 2
Select Escape to convert special characters to HTML entities, or Unescape to convert entities back to characters.
- 3
The result appears instantly — safe to paste into HTML attributes or templates.
- 4
Click Copy to copy the output.
Escape snippets before rendering user content inside templates or docs.
Decode copied entity strings back into readable HTML or text.
Review how markup-safe content should look before publishing or embedding.
Escape HTML special characters
<script>alert('xss')</script><script>alert('xss')</script>Escape an attribute value
Say "hello" & goodbyeSay "hello" & goodbyeUnescape HTML entities
<h1>Hello & World</h1><h1>Hello & World</h1>These answers explain common html escape/unescape tasks, expected input formats, and edge cases so both visitors and search engines can understand what this tool does.
What does HTML escaping do?
HTML escaping converts characters like <, >, &, quotes, and apostrophes into entity form so they render as text instead of being interpreted as markup.
When should I unescape HTML entities?
Unescape when you have copied encoded content such as <div> or & and you want to inspect the readable text or markup it represents.
Does HTML escaping make content fully secure?
It helps render text safely in HTML contexts, but full security still depends on the exact output context, templating system, and application behavior.
Can I use this tool for code snippets in docs or blogs?
Yes. It is useful for converting markup-heavy snippets into entity form so they display correctly inside documentation, CMS editors, and tutorials.
In browsers, create a temporary DOM element to escape HTML reliably. In Node.js, use a library like he or escape manually.
// Escape using a temporary DOM element (most reliable in browsers)
function escapeHtml(str) {
const div = document.createElement("div");
div.appendChild(document.createTextNode(str));
return div.innerHTML;
}
function unescapeHtml(str) {
const div = document.createElement("div");
div.innerHTML = str;
return div.textContent ?? "";
}
const raw = '<script>alert("xss")</script> & "quotes"';
console.log(escapeHtml(raw));
// <script>alert("xss")</script> & "quotes"