HTML Entities Escape / Unescape
Escape <, >, &, quotes to HTML entities, or reverse them. Also supports common programming string escapes.
HTML entities let you display reserved markup characters as text. Without them, a '<' would be parsed as the start of a tag instead of literal content. Entities come in two forms: named shortcuts like & and <, or numeric references such as & that cover any Unicode code point.
The same page also offers C-style string escapes (\n, \t, \") for when you are preparing text for a JSON string, a shell command, or source code rather than markup.
Escaping & first prevents double-encoding: '<' becomes '&lt;' if the order is wrong. The tool handles the ordering automatically.
Common uses
- Displaying a code snippet on a web page without the browser interpreting the tags.
- Sanitizing user-supplied text before inserting it into an HTML template to reduce XSS risk.
Frequently asked questions
- Is escaping enough to prevent XSS?
- Escaping <, >, & and quotes blocks the simplest injection, but a full Content Security Policy and output encoding appropriate to the context are still required.
- Why does & have to be escaped first?
- If you escape & last, '<' would be double-escaped into '&lt;'. This tool handles the ordering for you.
- Do I need to escape quotes inside attributes?
- Yes. If an attribute value is wrapped in double quotes, any literal double quote inside must become " or the attribute will be terminated early.
- Do I need to escape '/'?
- No. Forward slash has no special meaning in HTML and can be left as-is in both text and attributes.