Free HTML Escape / Unescape Tool Online - Entity Encoder Decoder
17 usesHTML Entity Reference
| Character | Entity Name | Entity Number | Description |
|---|---|---|---|
| < | < | < | Less than, tag opening |
| > | > | > | Greater than, tag closing |
| & | & | & | Ampersand, entity start |
| " | " | " | Double quote, attribute delimiter |
| ' | ' | ' | Single quote, attribute delimiter |
|   | Non-breaking space | |
| © | © | © | Copyright symbol |
| ® | ® | ® | Registered trademark |
HTML Escaping Guide
What is HTML Escaping?
HTML escaping converts special characters like < > & into entity codes, preventing browsers from interpreting them as HTML markup.
XSS Prevention
Escaping user input is critical for preventing Cross-Site Scripting (XSS) attacks, where malicious scripts get injected into web pages.
Display Code Snippets
When showing HTML source code on a web page, you must escape the tags so they display as text instead of being rendered.
Data Safety
Escape user-generated content before rendering it in HTML. Modern frameworks like React and Vue do this automatically.
Entity Formats
HTML entities come in two forms: named (<) and numeric (<). Both produce the same result — named entities are more readable.
Must-Escape Characters
Five characters must always be escaped in HTML: < > & " ' — they have special meaning in HTML syntax.
Frequently Asked Questions
Should I escape when storing data or when displaying it?
Best practice is to escape when displaying (output encoding). Store raw data for search and flexibility. Different output contexts (HTML, JSON, URL) need different encoding.
What is the difference between and a regular space?
is a non-breaking space that won't be collapsed by browsers and won't cause a line break at that position. Multiple regular spaces are collapsed into one.
Do single quotes need to be escaped in HTML?
It depends on context. In attribute values wrapped with single quotes, yes. Best practice: always escape both ' and " (using ' and ") for safety in all contexts.
Why do modern frameworks auto-escape HTML?
Frameworks like React, Vue, and Angular auto-escape interpolated content to prevent XSS by default. You must use special methods (v-html, dangerouslySetInnerHTML) to insert raw HTML.
Does JSON need HTML escaping?
JSON has its own escape rules. But if JSON content will be embedded in an HTML page or rendered as HTML, you still need HTML escaping for that output context.
What is the difference between HTML encoding and URL encoding?
HTML encoding (or escaping) converts special characters like <, >, &, ", ' into HTML entities (e.g., <, >) to prevent browsers from interpreting them as code. It's crucial for XSS prevention when displaying user-generated content in web pages. URL encoding, conversely, transforms unsafe characters (e.g., spaces, &, =, /) into percent-encoded sequences (e.g., %20, %26) so they can be safely transmitted within a URL path or query string. They serve distinct purposes for different web contexts.
How do I display actual HTML tags or code snippets safely within a web page?
To display literal HTML tags or programming code snippets within an HTML page without the browser interpreting them, you must HTML escape the content. This converts characters like `<`, `>`, `&`, and quotes into their respective HTML entities (e.g., `<`, `>`, `&`). When these entities are placed within elements like `<pre>` or `<code>`, the browser renders them as the original characters, ensuring the code displays correctly and prevents accidental execution.
Why am I seeing HTML entities like `&` or `<` instead of the actual characters on my webpage?
This often happens when text has been HTML-escaped multiple times, or when data is retrieved from a database that didn't properly decode previously escaped content. Your browser is then displaying the *literal* entities instead of rendering them as characters. Using an HTML unescape tool can convert these `&` and `<` back into `&` and `<` respectively, ensuring your content displays correctly and as intended without broken characters.
My database content shows HTML entities like `&` or `<`, how do I decode them for display on my website?
When content retrieved from a database displays HTML entities instead of actual characters, it means the text was HTML escaped before storage. To correctly render this on your webpage, you need to use an HTML unescape tool. This converts entities like `&` back to `&` and `<` to `<`, ensuring your special characters and original formatting appear as intended, rather than as raw entity codes.
How can I quickly HTML escape or unescape a list of items from a spreadsheet or text file?
Our online HTML escape tool is perfect for batch processing. Simply copy and paste your entire column or list of strings into the input area. The tool will instantly convert all special characters to HTML entities (escaping) or decode them back (unescaping). This saves significant time when preparing data from spreadsheets, CSVs, or text files for web display, ensuring XSS prevention or correct rendering.
How to Use
- Enter or paste HTML/text in the input box
- Click Escape to convert special characters to HTML entities
- Click Unescape to convert entities back to characters
- The HTML preview shows how the output renders in a browser
- Use Swap to quickly exchange input and output
- All processing runs locally in your browser — no data is transmitted