Escape / Unescape

HTML Escape / Unescape

Convert text to safe HTML entities and back — <, >, & and quotes handled, named and numeric entities decoded.

In short

Escape and unescape HTML online: convert <, >, &, and quotes to entities and back. Prevent broken markup and XSS when embedding text in pages. Free.

By NaveenKumar T · Updated 17 Sep 2026

Learn: HTML Entities Explained: When to Escape &, <, > and Quotes

Escape & unescape in one tool
Handles every special character
Instant as you switch modes

Runs entirely in your browser — nothing you paste or open here is uploaded, logged, or stored.How we handle data →

Example

HTML Escape: input and output

Escaping a code snippet so a tutorial page shows it literally instead of executing it.

Text

<button onclick="save()">Save & exit</button>
if (x < 10 && y > 2) alert('Zoë says "hi"');
Prix : 12 € — c'est déjà réservé

Escaped HTML

&lt;button onclick=&quot;save()&quot;&gt;Save &amp; exit&lt;/button&gt;
if (x &lt; 10 &amp;&amp; y &gt; 2) alert(&#39;Zoë says &quot;hi&quot;&#39;);
Prix : 12 € — c&#39;est déjà réservé

Only the five special characters changed — the accented letters, the euro sign and the line breaks come through untouched, and each apostrophe became ' rather than '.

Learn more

HTML escaping rules

Five characters are dangerous in HTML: < and > open and close tags, & starts entities, and both quote styles can end attribute values. Escaping converts them to entities — <, >, &, ", ' — so the browser renders your text literally instead of parsing it as markup. This is also the first line of defense against XSS: user content embedded without escaping is an injection waiting to happen.

Unescaping reverses the process and is more involved than it looks: this tool decodes the named entities you'll meet in real pages ( , ©, —, … and friends) plus every numeric form (' and '), turning scraped or exported HTML back into clean text.

Help

Frequently asked questions

Everything you need to know about the HTML Escape.

01How do I escape or unescape HTML here?

Paste your text, pick Escape or Unescape in the Mode select, and press Convert. Escape converts the five HTML-unsafe characters to entities; Unescape decodes named entities like   and © plus numeric references back to plain text.

02Should I escape user input with this before putting it in a page?

For quick jobs and debugging, yes — this implements the standard five-character escape. In application code, use your framework's built-in escaping (it runs automatically in React, Vue, and most template engines) so the protection can't be forgotten on one code path.

03Why is the apostrophe escaped as ' instead of '?

' was defined for XML and only joined HTML in HTML5, so old browsers and some email clients print it literally; the numeric ' has always worked everywhere, which is why Escape mode emits it. Nothing else is touched: accented letters, emoji and line breaks pass through unchanged, since a UTF-8 page renders them directly. Unescape accepts both forms — plus decimal and hex references and the common named entities — and turns   into an ordinary space.

Keep working