HTML Escape / Unescape
Convert < > & into HTML entities, or decode entities back to text.
How it works
Convert characters like <, > and & into HTML entities so they display as text instead of being treated as markup — or turn entities back into readable characters.
Try an example
—Escaping is what prevents user-supplied text from being parsed as markup — the core defence against cross-site scripting when inserting text into a page.
🔒 Processed entirely in your browser — your text is never uploaded or stored.
About the HTML Escape / Unescape
This free HTML escape tool converts characters that browsers treat as markup — < > & " ' — into HTML entities, so they display as text instead of being parsed as tags. It also works in reverse, decoding entities back into readable characters.
It runs entirely in your browser, so nothing you paste is uploaded.
When you need to escape HTML
- Showing code examples on a web page without the browser rendering them.
- Putting user-supplied text into a page safely.
- Storing markup inside an HTML attribute or another document.
The main entities
- < becomes < and > becomes >
- & becomes & — escape it first, or you double-escape everything else.
- " becomes " and ' becomes '
Frequently asked questions
What does escaping HTML do?
It replaces characters that have special meaning in HTML with entity codes, so the browser displays them as literal text rather than interpreting them as markup.
Why does escaping matter for security?
Escaping user-supplied text before inserting it into a page is the core defence against cross-site scripting (XSS) — it stops input like <script> from being executed as code.
Can it decode entities back to text?
Yes. Switch to unescape mode to convert named entities like & and numeric ones like © back into characters.
Is my text uploaded?
No. Escaping and unescaping happen entirely in your browser.