HTML Escape and Unescape Online

Convert HTML special characters to entities, or decode entities back to text. Both panes are editable and update each other as you type.

0Entities
0Unrecognized
—Size change

Decoding covers around 250 named entities plus every decimal © and hexadecimal © reference. An unrecognized name is left exactly as written rather than deleted, and is counted above.

What is HTML Escape and Unescape?

HTML escaping replaces characters that the parser would otherwise read as markup with character references. The five that matter are &, <, >, the double quote, and the apostrophe; each becomes a named entity such as &amp; or a numeric reference such as &#39;. Escaping is what lets you print a code sample, a query string, or user-supplied text inside a page without the browser treating it as a tag, and it is the first line of defense against cross-site scripting in HTML text and quoted attribute values. Unescaping goes the other way, turning named entities, decimal references, and hexadecimal references back into the characters they stand for.

How to use

  1. Paste raw HTML or plain text in the left pane to see the escaped version on the right.
  2. Paste entity-encoded text in the right pane to decode it back to readable characters.
  3. Tick the non-ASCII option to convert accents and emoji to numeric entities, then copy either side.

Frequently asked questions

Which characters must be escaped in HTML?

The ampersand and less-than sign are mandatory in text; the greater-than sign and quotes are escaped by convention and are mandatory inside attribute values. This tool escapes all five by default.

Does escaping HTML stop XSS?

It stops injection in HTML text and quoted attributes. It does nothing for script blocks, unquoted attributes, or a javascript: URL in an href, so escape at the point of output for that context.

What is the difference between named, decimal, and hex entities?

Three spellings of the same character. A named entity is readable but limited to a fixed list; decimal and hex references work for any Unicode code point. All three decode here.

Is unescaping done with innerHTML?

No. innerHTML would run any script or onerror handler in the input. Decoding uses a named-entity lookup table plus a regex for numeric references, so nothing is parsed as markup.

Last updated

Powered by maratool