EN
ENARDEESFAFRHEHIIDITJAKONLPLPT-BRRORUTHTLTRUKVIZH

General dev

HTML Escape / Unescape

Runs locally

Use HTML Escape / Unescape

What it does

Escape the five characters that matter in HTML (& < > " ') so text is shown as text instead of being parsed as markup, or unescape them again.

It runs entirely in your browser: nothing you enter is uploaded.

Example

Link markup

Input
<a href="https://example.com/?q=1&lang=en">Sign in</a>
Output (captured 2026-10-20)
&lt;a href=&quot;https://example.com/?q=1&amp;lang=en&quot;&gt;Sign in&lt;/a&gt;

Escape gives &lt;a href=&quot;https://example.com/?q=1&amp;lang=en&quot;&gt;Sign in&lt;/a&gt;, which a browser displays as text instead of a link.

FAQ

Does escaping make any input safe from XSS?

It is enough for text placed between tags or inside a quoted attribute value. It is not enough inside a script or style block, an unquoted attribute or a URL attribute such as href, where a javascript: link still runs.

Which entities does Unescape understand?

Only &amp; &lt; &gt; &quot; &#39; and &#x27;. Numeric entities such as &#80; and named ones such as &nbsp; stay unchanged, and &amp;lt; is decoded twice, giving a less-than sign instead of &lt;.

Is my text uploaded?

No. Both directions are simple text replacements in your browser; nothing is sent anywhere.

  • CSP Header Builder

    Build a Content-Security-Policy header from 13 directives such as script-src, form-action and frame-ancestors.

  • llms.txt Generator

    Generate an llms.txt Markdown file (llmstxt.org proposal) from your site name, summary and key page links.

Browse all 161 tools