# HTML Escape / Unescape

URL: https://phishdestroy.io/developer-tools/html-entity-encoder
Category: General dev
Where it runs: Runs locally (nothing you enter is uploaded)

Escape the five characters that matter in HTML (& < > " ') so text is shown as text instead of being parsed as markup, or unescape them again.

## Example input

Link markup

```
<a href="https://example.com/?q=1&lang=en">Sign in</a>
```

Escape gives &lt;a href=&quot;https://example.com/?q=1&amp;lang=en&quot;&gt;Sign in&lt;/a&gt;, which a browser displays as text instead of a link.

## FAQ

### Does escaping make any input safe from XSS?

It is enough for text placed between tags or inside a quoted attribute value. It is not enough inside a script or style block, an unquoted attribute or a URL attribute such as href, where a javascript: link still runs.

### Which entities does Unescape understand?

Only &amp; &lt; &gt; &quot; &#39; and &#x27;. Numeric entities such as &#80; and named ones such as &nbsp; stay unchanged, and &amp;lt; is decoded twice, giving a less-than sign instead of &lt;.

### Is my text uploaded?

No. Both directions are simple text replacements in your browser; nothing is sent anywhere.

## Related tools

- [JSON & JavaScript String Escaper](https://phishdestroy.io/developer-tools/string-escaper)
- [URL Encoder / Decoder](https://phishdestroy.io/developer-tools/url-encoder-decoder)
- [Base64 Encoder / Decoder](https://phishdestroy.io/developer-tools/base64-encoder-decoder)
- [CSP Header Builder](https://phishdestroy.io/developer-tools/csp-header-builder)
- [HTML Attachment Analyzer](https://phishdestroy.io/developer-tools/html-attachment-analyzer)

All tools: https://phishdestroy.io/developer-tools