Developer Tools
HTML Escape and Unescape
Escape five HTML characters or decode named and numeric references in your browser. For ordinary HTML text and quoted attributes; not an HTML sanitizer.
About HTML Escape and Unescape
Escape HTML characters for text and quoted attributes
Paste text and choose Escape to replace five characters: & becomes &, < becomes <, > becomes >, " becomes ", and ' becomes '.
For example, <p title="Tom & Ana">Hello, world!</p> becomes <p title="Tom & Ana">Hello, world!</p>. This represents markup as text. Escaping an already escaped value adds another layer: < becomes &lt;.
Decode named and numeric character references
Choose Unescape to decode 2,125 named HTML references, plus decimal and hexadecimal numeric references. A trailing semicolon is required. For example, Tom & Ana 🧪 becomes Tom & Ana 🧪. Names are case-sensitive; unknown names and references without a semicolon stay unchanged.
Conversion runs once: &lt; becomes <, not a less-than sign. Numeric references for zero, surrogate values or values above U+10FFFF become the replacement character U+FFFD. Some control values use the HTML character-reference mappings; for example, € becomes the euro sign. This tool is a text converter, not a complete HTML parser.
Where HTML escaping helps—and where it does not
The escaped output is intended for ordinary HTML text and ordinary attribute values enclosed in quotes. Keep attribute names fixed and trusted. This conversion does not sanitize HTML, remove dangerous elements or make JavaScript, CSS, event attributes, unquoted attributes or URLs safe. A value such as javascript:alert(1) is not made safe for a link merely by escaping HTML characters.
Use context-appropriate encoding and validation in your application. Frameworks often escape text automatically, so manual escaping can produce unwanted double encoding. Decoded text may contain executable markup: do not insert it into an HTML execution context without the appropriate safeguards. This page displays results as text.
Input limits, copying and UTF-8 downloads
Escape accepts up to 100,000 UTF-16 code units. Unescape accepts up to 600,000; results are also bounded at 600,000. A supplementary character such as many emoji counts as two units. Unpaired surrogates are rejected. Changing the mode preserves your draft; Move result to input and reverse replaces the draft with the current result and switches modes. That action is unavailable when the next input would exceed its limit.
Copy the result, select it for manual copying, or download it as a UTF-8 text file. Clipboard completion may be delayed; wait for a pending copy before performing other clipboard operations. The download preserves result line endings and a leading U+FEFF, while display or clipboard destinations may normalize line endings. “Started” means the download was requested, not that the browser confirmed a saved file.
Conversion runs in your browser; the converter does not send your input or result to a server. The site still makes ordinary page and analytics requests. Keep sensitive content out of shared devices and shared clipboards.
Frequently asked questions
- Q. What is the difference between escape and unescape?
- Escape replaces &, <, >, double quotes and single quotes with HTML references. Unescape restores supported references in one pass. For example, Tom & Ana becomes Tom & Ana when unescaped.
- Q. Does this make arbitrary HTML safe?
- No. It encodes text for ordinary HTML text and quoted ordinary attribute values. It is not an HTML sanitizer and does not secure JavaScript, CSS, event attributes, unquoted attributes or URLs. Decoded output must not be treated as safe HTML.
- Q. Why does &lt; not become a less-than sign in one pass?
- Only one layer is decoded at a time. &lt; becomes <. Unescaping again would produce <. This avoids recursively decoding more than one layer without your action.
- Q. Are semicolons required?
- Yes. This converter requires the final semicolon, supports 2,125 case-sensitive named references and decimal or hexadecimal numeric references, and preserves unknown names. Its rules differ from parsing an entire HTML document.
- Q. What are the size limits?
- Escape input is limited to 100,000 UTF-16 code units; unescape input and results are limited to 600,000. Many emoji use two units. Unpaired surrogates are rejected.
- Q. Will the downloaded file preserve line endings?
- The UTF-8 download preserves the result’s line endings and leading U+FEFF. Display and clipboard destinations may normalize line endings. Unescape can change characters by design, so it is not a byte-for-byte restoration of every original file.
- Q. Is the text uploaded?
- The converter processes text in your browser without uploading the input or result. Ordinary page and analytics requests still occur. Clipboard operations and downloaded files are handled by your browser and device.
Sources and specifications
Related tools
URL Encoder and Decoder
Encode URI components or complete URIs, decode UTF-8 percent escapes, and copy or download results in your browser. Includes encodeURIComponent and encodeURI outputs.
JSON Formatter and Validator
Validate JSON syntax, format or minify it while preserving number notation, string escapes and duplicate keys. Preview your input and inspect its structure in your browser.
Questions or feedback? Contact NanToo
Rate this tool
—(0 ratings)