Security

HTML Escaper and Unescaper

Escapes the five characters that matter for safe HTML, and decodes entities back the other way.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Paste the text you want to place safely into a page, or the escaped HTML you want to read.
  2. Select Escape or Unescape.
  3. Use the result for documentation and inspection. In an application, let the template engine escape output automatically rather than doing it by hand.

What html escaper does

Five characters need escaping before text can be dropped into a page: the ampersand, the two angle brackets, and both kinds of quote. The angle brackets are the famous ones, because they let text become a tag. The quotes matter just as much and are the ones people forget, because text placed inside an attribute can escape that attribute with a quote alone and never need a bracket at all.

This is a tool for inspecting and preparing content, not a security control. The right place to escape output is in the template engine that renders it, automatically, on every value. Escaping by hand in a utility and pasting the result is fine for a snippet of documentation and is not a substitute for output encoding in the application itself.

Frequently asked questions

Five: & < > " and '. The angle brackets stop text becoming a tag; the two quotes stop text inside an attribute breaking out of that attribute. Escaping the brackets and not the quotes is a common half-measure that leaves a real hole.

No. Escaping by hand in a utility protects the one snippet you pasted. Protecting an application means escaping on output, automatically, for every value — which is what a template engine does by default. Use this to inspect and prepare content, not as a security control.

The five standard entities and any numeric reference such as &#233; or &#x2014; are decoded. The several hundred other named entities are deliberately not, because a wrong guess would silently corrupt the text. Anything left as an entity is visible, which is the safer failure.