HTML entity escape
Convert between raw text and HTML entities (& < > " ')
Encode raw text or decode an entity string. The result is displayed as text and is never executed as HTML.
Example
Input
<p>A & B</p>
Example result
<p>A & B</p>
Decode once to recover the text. The output is not executed as HTML.
Technical details & limits
Escaping replaces characters in one pass so newly inserted entities are not encoded again in that pass. Decoding supports amp, lt, gt, quot, apos and numeric references, not the full named-entity catalog. HTML text, attributes, JavaScript and URLs require different context-specific escaping.
About this tool
Escape &, <, >, double quotes and apostrophes for HTML, or decode common named and numeric character references. Display literal markup in page text, examples and templates; results remain plain text.
Use cases
- Escape user input before dropping it into HTML to prevent XSS.
- Paste an HTML snippet into a blog or docs page as example code.
- Decode entity-encoded text (`&`, `<`) back to readable form.
How to use
- Paste the text into the input.
- Click Escape to turn it into entities, or Unescape to decode.
Notes
Only five common named references and numeric references are supported. Other names, such as , are left unchanged.
FAQ
- Why should angle brackets and quotes be HTML-escaped?
- HTML escaping allows angle brackets and quotes to appear as text instead of being interpreted as markup. The less-than character can be written as <, and a double quote as ". This tool helps inspect those text representations. Escaping requirements depend on the output context, so HTML text escaping alone is not a substitute for the separate handling required inside scripts, attributes, or URL values.
- How do decimal and hexadecimal HTML character references decode?
- Decimal and hexadecimal HTML character references can identify the same Unicode code point. For example, A and A both represent the letter A, using 2 different numeric notations. This tool supports numeric references and a limited set of common named entities. It is not a complete named-entity dictionary, so verify unfamiliar named references before relying on the output in a document or template.
- Why does escaping HTML twice produce amp-lt text?
- Escaping HTML twice escapes the entity prefix created by the first pass, causing entity text to appear instead of the intended character. Escaping a less-than sign 1 time produces <, while 2 passes produce &lt;. Trace the processing layers before adding another decode step. Usually, output should be escaped for its actual destination once, while the original data is preserved separately for editing or storage.
Related tools
URL encode / decode
Unicode escape
Color format converter