No Login Data Private Local Save

HTML Escape/Unescape - Online Encode Special Characters

13
0
0
0

HTML Escape / Unescape

Encode special characters to HTML entities or decode them back — fast, free & online

0 chars 0 chars
Plain Text / Input
Escape Unescape
Copy Swap
Escaped HTML / Output
Common HTML Entities Reference
Character Description Named Entity Numeric Entity
&Ampersand&&
<Less-than&lt;&#60;
>Greater-than&gt;&#62;
"Double quote&quot;&#34;
'Single quote&apos;&#39;
©Copyright&copy;&#169;
®Registered&reg;&#174;
™Trademark&trade;&#8482;
€Euro sign&euro;&#8364;
—Em dash&mdash;&#8212;
 Non-breaking space&nbsp;&#160;
Frequently Asked Questions
What is HTML escaping?

HTML escaping (also called HTML encoding) is the process of converting special characters — such as <, >, &, ", and ' — into their corresponding HTML entity representations. This prevents browsers from interpreting them as actual HTML markup, ensuring code snippets display correctly on web pages and protecting against cross-site scripting (XSS) vulnerabilities.

When should I use HTML escape?

Use HTML escaping whenever you display user-generated content, embed code examples in a webpage, write HTML tutorials or documentation, send HTML emails, or work with templating engines. It's essential for safely rendering text that might contain characters with special meaning in HTML.

Which characters need to be escaped in HTML?

The five characters that should always be escaped are: & (ampersand → &amp;), < (less-than → &lt;), > (greater-than → &gt;), " (double quote → &quot;), and ' (single quote → &apos; or &#39;). Failing to escape these can break your HTML layout or introduce security risks.

What's the difference between named and numeric HTML entities?

Named entities use readable names (e.g., &lt; for <), making them easy to remember and write. Numeric entities use decimal or hexadecimal code points (e.g., &#60; or &#x3C; for <). Both are equally valid in HTML5, though named entities are generally preferred for readability when available.

Is HTML escaping enough to prevent XSS attacks?

HTML escaping is a critical layer of defense against XSS, but it's not sufficient on its own. You should also use Content Security Policy (CSP) headers, validate and sanitize all user inputs, escape output based on context (HTML body, attributes, JavaScript, CSS, or URLs), and keep frameworks and libraries up to date. Defense in depth is essential for robust security.

Can this tool handle large blocks of text?

Yes! Our tool processes text efficiently using browser-native DOM parsing and string replacement. It handles thousands of characters instantly. For extremely large inputs (100,000+ characters), you may want to disable real-time mode for smoother performance.

What does the "Unescape" mode do?

Unescape (or HTML decoding) reverses the escaping process — it converts HTML entities like &lt;, &quot;, &#169; back into their original characters (<, ", ©). This is useful when you receive escaped HTML content and need to read or edit the original text.

🔧 Related Tools