HTML entity escape
Convert between raw text and HTML entities (& < > " ')
Encode raw text or decode an entity string. The result is displayed as text and is never executed as HTML.
Example
Input
<p>A & B</p>
Example result
<p>A & B</p>
Decode once to recover the text. The output is not executed as HTML.
Technical details & limits
Escaping replaces characters in one pass so newly inserted entities are not encoded again in that pass. Decoding supports amp, lt, gt, quot, apos and numeric references, not the full named-entity catalog. HTML text, attributes, JavaScript and URLs require different context-specific escaping.
About this tool
Escape &, <, >, double quotes and apostrophes for HTML, or decode common named and numeric character references. Display literal markup in page text, examples and templates; results remain plain text.
Use cases
- Escape user input before dropping it into HTML to prevent XSS.
- Paste an HTML snippet into a blog or docs page as example code.
- Decode entity-encoded text (`&`, `<`) back to readable form.
How to use
- Paste the text into the input.
- Click Escape to turn it into entities, or Unescape to decode.
Notes
Only five common named references and numeric references are supported. Other names, such as , are left unchanged.
FAQ
- Why escape `&`?
- Because `&` starts every HTML entity. Not escaping it lets browsers try to read the trailing text as an entity.
- Do I need to escape single quotes?
- Single-quoted HTML attributes need apostrophe escaping. Other contexts have their own rules; this output is not automatically safe JavaScript, CSS or a URL.
- Why does &lt; become only <?
- It has two encoding layers. A single pass removes only one layer so intentionally literal entity text is preserved.
- Why does escaping twice produce &amp;?
- A second encoding escapes the ampersand introduced by the first. Check whether the input is raw or already escaped; reuse the output as input only when another pass is intended.
Related tools
URL encode / decode
Unicode escape