HTML Escape / Unescape
Escapes or unescapes an HTML string, replacing characters that could be wrongfully interpreted as markup with their HTML entities.
Result
HTML escaping explained
Why escape HTML?
In HTML a handful of characters have a special meaning: < and > delimit tags, & starts a character reference, and quotes delimit attribute values. When one of these characters appears in content (a user's comment, a product name, a code sample…) it must be replaced by a character reference, otherwise the browser will try to interpret it as markup. Forgetting to do so is the root cause of cross-site scripting (XSS) vulnerabilities and of countless rendering glitches.
Unescaping is the reverse operation: character references (é, é, é) are turned back into the characters they represent.
Rules applied by this tool
| Character | Escaped as | Why |
|---|---|---|
& (ampersand) | & | Starts every character reference. It must always be escaped first. |
< (less than) | < | Opens a tag. |
> (greater than) | > | Closes a tag. Escaping it is optional in text but recommended. |
" (double quote) | " | Delimits attribute values. |
' (single quote) | ' | Also delimits attribute values. The numeric form is used because ' is not defined in HTML 4. |
| ISO-8859-1 characters and symbols (é, ü, ©, €, →, …) | Named entity such as é, ©, € | Only when the first option is checked. Uses the 252 entities defined by HTML 4 (Latin-1, Greek letters, math symbols, arrows). |
| Any other non-ASCII character (e.g. 日, 😀) | Decimal reference 日 | Only when the second option is checked. Useful when the page is not served as UTF-8. |
The complete list of named entities, with their numbers and descriptions, is available on the HTML entities page.
Before / after
| Input | Escaped output |
|---|---|
<a href="x">é & ü</a> | <a href="x">é & ü</a> |
5 > 3 && 2 < 4 | 5 > 3 && 2 < 4 |
It's "quoted" | It's "quoted" |
Price: 10 € © 2024 | Price: 10 € © 2024 |
Unescaping
The unescape button understands all three forms of character references: named ( ), decimal ( ) and hexadecimal ( ). Unknown entity names are left untouched. Note that unescaping user-supplied text and inserting the result into a page re-introduces the exact XSS risk that escaping prevents; only unescape data you intend to treat as text.
In code
// JavaScript (text nodes escape automatically)
element.textContent = untrustedString;
// PHP
echo htmlspecialchars($s, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
// Java (Apache Commons Text)
StringEscapeUtils.escapeHtml4(s);
// Python
import html; html.escape(s, quote=True)