At One Place

HTML escape and unescape

Convert characters to HTML entities so markup displays as text, or convert back.

How it works

Escapes the characters that have meaning in HTML — & < > " and ’ — into their entity forms, so markup displays as literal text instead of being rendered. Unescaping reverses it.

The ampersand must be escaped first, and this tool does that. Escaping it last would double-escape every entity produced by the earlier substitutions, turning &lt; into &amp;lt;. It is the classic ordering bug in hand-written escaping.

Escaping user input before inserting it into a page is the basic defence against cross-site scripting, though using the DOM’s textContent rather than innerHTML is safer still, because it never treats the input as markup at all.

This tool runs entirely in your browser. Nothing you enter is sent to a server, logged or stored, and the page keeps working with the network disconnected.

Common questions

Which characters need escaping in HTML?
At minimum & < and >, plus double and single quotes inside attribute values. The ampersand must be escaped first or the others get double-escaped.
Is escaping enough to prevent XSS?
It is the basic step, but context matters — escaping rules differ inside attributes, URLs and script blocks. Setting textContent rather than innerHTML avoids the problem entirely.

Related pages

  • Word and character counter Words, characters, sentences, paragraphs and reading time, counted as you type.
  • Typing speed test Measure words per minute and accuracy on a one, two or five minute test.
  • Remove duplicate lines Strip repeated lines from a list, keeping the first occurrence of each.
  • Sort lines alphabetically Sort a list of lines A–Z, Z–A, by length, or numerically.
  • JSON formatter and validator Pretty-print, minify and validate JSON, with the exact position of any error.
  • Text compare Compare two blocks of text and see which lines were added, removed or changed.
  • Regex tester Test a regular expression against sample text, with matches and capture groups shown.
  • Case converter Convert text between upper, lower, title, sentence, camel, snake, kebab and other cases.
  • Remove empty lines Delete blank lines from a block of text, optionally collapsing runs to one.
  • Find and replace Replace every occurrence of a string in pasted text, with optional regex.