How to escape or unescape HTML
- Choose Encode (escape) to turn special characters into entities, or Decode (unescape) to turn entities back into ordinary characters.
- Paste your text or markup into the top box. The output below changes as you type.
- When encoding, tick Also encode non-ASCII characters if the result has to survive a system that only handles plain ASCII.
- Click Copy, or ⇅ Swap to feed the result back in with the opposite mode and confirm you get the original text.
What the encoder changes
Encoding replaces exactly five characters, the ones that can change how a browser reads a page:
| Character | Becomes | Why it matters |
|---|---|---|
& | & | Starts an entity, so a bare ampersand can be misread |
< | < | Opens a tag |
> | > | Closes a tag |
" | " | Ends a double-quoted attribute value |
' | ' | Ends a single-quoted attribute value |
All five are replaced in a single pass, so the ampersands added by the escapes themselves are never escaped again. Everything else, including curly quotes, accented letters and emoji, is left untouched unless you tick the non-ASCII option. With that option, every character outside ASCII is written as a decimal numeric reference based on its Unicode code point: é becomes é, € becomes € and 😀 becomes 😀.
Decoding understands the full set of named entities defined by HTML (é, , ♥ and so on) as well as decimal (é) and hexadecimal (é) references. Tags in the input stay as plain text; nothing is rendered or run.
Examples
Showing a code snippet in a blog post
Paste if (a < b && b > c) and the encoder returns if (a < b && b > c). Put that inside <pre><code> and readers see the original line instead of a broken page.
Markup with quotes and typography
The sample text <p class="note">Tom & Jerry’s “best” café</p> becomes <p class="note">Tom & Jerry’s “best” café</p>. With non-ASCII encoding switched on, the curly apostrophe, curly quotes and é also change: Jerry’s “best” café.
Fixing double-escaped text
If a page shows & where an ampersand should be – Tom & Jerry – the text was escaped once when it was saved and again when it was displayed. Decode it once and check the result; decode again only if entities remain. The lasting fix is to escape in exactly one place, at output time.
Escaping and cross-site scripting (XSS)
When a site inserts user input into a page without escaping it, a visitor can submit something like <img src=x onerror="alert(1)"> and have the browser run it for everyone who views the page. Escaped, the same input turns into <img src=x onerror="alert(1)"> and is displayed as harmless text.
This kind of escaping protects two places: the text between tags and attribute values wrapped in quotes. It is not enough inside <script> blocks, inline event handlers, CSS, unquoted attributes or URLs such as href values, where a javascript: link needs no special characters at all. In real applications, rely on your template engine’s automatic escaping and use this tool to inspect or prepare individual strings.
Tips
- Pages saved as UTF-8 can contain é, ü, 한글 or 中文 directly; encoding them only makes the source harder to read. Use the non-ASCII option for legacy email templates, old CMS fields or files whose encoding you can’t control.
decodes to a non-breaking space (U+00A0), which looks like a space but isn’t one. It can break searches and comparisons in code, so replace it if exact matching matters.- Entities belong to HTML and XML. For links, use URL encoding; inside JSON strings, use JSON’s own escapes (a JSON formatter shows whether a string is valid).
FAQ
What is the difference between ' and '?
Both stand for an apostrophe. ' is defined in XML and HTML5 but was missing from HTML 4, so the numeric form ' works in every browser and email client. That is why the encoder uses it.
Should I use named or numeric entities?
Either decodes to the same character. Named ones such as © are easier to read; numeric ones exist for every Unicode character, while names exist only for a selection.
Why don’t I need to escape > in normal text?
Strictly, a lone > in text is harmless, and only < and & must be escaped there. Escaping all five consistently means the same output is also safe inside quoted attributes.
Does decoding run any code I paste?
No. Decoding only converts entities to characters, and the result is shown as plain text in a read-only box.