HTML Escape/Unescape
Escape HTML special characters to entities, or unescape named, decimal, and hex character references locally for tag display and code examples.
Input Text
Characters
0 / 50,000
Quick Start
Common scenarios
User comments
escape untrusted text before displaying it inside an HTML content area.
Blog posts
display HTML tags and snippets in articles.
Forum posts
show user text without letting pasted tags render as markup.
Chat messages
turn pasted markup into visible text before it reaches an HTML content area.
Form data
inspect and copy escaped values before displaying submitted text.
Code display
show HTML or JavaScript snippets on web pages.
Escaping Rules & Entities
Escape vs Sanitization Boundaries
Usage Advice
Limitations & Compatibility
Privacy & Security
FAQ
XSS (Cross-Site Scripting) happens when untrusted content is interpreted as script or markup in a page. HTML escaping helps in HTML content contexts, but it is only one part of XSS prevention.
Use HTML escaping when untrusted text is inserted into an HTML content or attribute context. Prefer textContent or your framework default escaping for plain text, and use different escaping for JavaScript, CSS, URL, or JSON contexts.
Both represent <. < is a named entity; < and < are numeric and hex character references. In modern HTML they usually behave the same. Keep the trailing semicolon so the parser does not merge the entity with following letters.
No. HTML escaping only works for HTML entity contexts. JavaScript strings, CSS, URLs, JSON, and rich HTML all require different handling.
This happens when content is escaped twice. First < becomes <, then the ampersand in < becomes &, producing &lt;. Avoid applying escape to already escaped text.
Use sanitization, not this escape tool. A sanitizer can allow-list tags and attributes, filter protocols, and remove events or styles. Use libraries such as DOMPurify or sanitize-html, sanitize on the server when possible, and use textContent for plain text.