HTML Escape / Unescape

Escape or unescape HTML entities including named, decimal, and hex numeric entities.

HTML / Text Input

Escaped Output

HTML Entity Reference

Character	HTML Entity	Named Entity
&	&	ampersand
<	<	less-than
>	>	greater-than
"	"	double quote
'	'	single quote
		non-breaking space
©	©	copyright
®	®	registered
™	™	trademark

Where HTML Escaping Matters Most

▸Rendering user-generated content — Comments, reviews, usernames and bios must be escaped before insertion into HTML, or a name like <script>alert(1)</script> becomes executable code.
▸Displaying code samples — A tutorial showing <div> or & in a <pre> block needs escaping, or the browser tries to parse it as real markup instead of showing it as text.
▸Building HTML email templates — Email clients render raw HTML — unescaped user data in a template is as risky as it is in a web page.
▸Server-side templating without auto-escaping — Some template engines and raw string concatenation don't escape by default — this tool lets you verify the escaped output before shipping it.

When to Escape HTML

Context	Required	Reason
User-generated content in HTML	Yes	Prevents XSS attacks
Code samples in <pre> blocks	Yes	Angle brackets would close tags
Attribute values	Yes	Quotes can break attributes
JSON in HTML <script>	Partial	Escape </script> closing tag
Template literals in JS	No	Use JS string escaping instead

Frequently Asked Questions

HTML escaping converts special characters to HTML entities so browsers display them as text rather than interpreting them as markup.

Yes — escaping user input before inserting it into HTML prevents reflected and stored XSS. Always escape on output, not on input storage.

' is valid in XML but NOT in HTML4. Use ' for maximum compatibility across HTML4, HTML5, and XML.

Emoji and most Unicode characters do not need escaping in UTF-8 HTML5. Only the 5 special characters (&, <, >, ", ') must be escaped.

Frameworks like React and Vue auto-escape text interpolated into JSX/templates by default, which covers the common case. You still need to escape manually when building raw HTML strings, writing to innerHTML, generating server-side email templates, or using an explicit 'render raw HTML' escape hatch (like dangerouslySetInnerHTML) with untrusted input.

Related Tools

JSON Escape / Unescape

Escape JSON to a string literal or unescape it

URL Encoder / Decoder

Encode or decode URLs — query, path, form encoding

Base64 Encoder / Decoder

Encode or decode Base64 — Standard, URL-safe, Raw

JSON Formatter

Beautify and format JSON with indentation

JSON Validator

Find syntax errors with line and column numbers

Regex Tester

Test regex patterns with match highlighting and RE2 notes