Escape or decode HTML entities instantly

Why Escape HTML?

Escaping HTML entities prevents injected tags or attributes from breaking your layout or introducing cross-site scripting (XSS) vulnerabilities. Every time your application renders user-generated content -- comments, form inputs, chat messages -- the raw text should be escaped before it reaches the DOM. Characters like <, >, &, and " are replaced with their entity equivalents so the browser treats them as display text rather than markup. This single step eliminates an entire class of security issues and is considered a baseline best practice in web development.

Named vs. Numeric Entities

HTML supports two entity styles. Named entities such as < are human-readable and widely recognized. Numeric entities such as < use the character's Unicode code point and work in every XML-compatible parser, making them the safer choice when output will be consumed by strict XML tools, RSS feeds, or XHTML documents. Toggle the "Use numeric entities" switch above to choose the format that fits your workflow.

When to Unescape

Unescaping converts entity references back to their original characters. This is useful when migrating content between systems, debugging double-encoded strings, or previewing how a stored value will actually render in the browser. Paste the escaped markup into the input field, click "Unescape," and the tool will decode all recognized entities in a single pass.

Common Use Cases

• Template previews: Decode legacy CMS content to verify what users will see on the front end.
• API payloads: Escape HTML in JSON string values before sending them to a rendering service.
• Email templates: Ensure special characters display correctly across email clients that interpret raw HTML.
• Documentation: Show code snippets in HTML pages without the browser interpreting the tags.