HTML Escape & Unescape
Convert HTML special characters to entities and back. Escape HTML to prevent XSS attacks and display code snippets safely, or unescape entities to restore original text. Supports extended entities including copyright symbols, currency signs, and mathematical operators.
Recommended Settings
HTML Escaping Best Practices
- •Always escape user-generated content before displaying it in HTML to prevent XSS attacks
- •Escape HTML when storing code snippets in databases or configuration files
- •Use extended entities for special characters like ©, ®, ™ to ensure cross-browser compatibility
- •Escape HTML in email templates to prevent rendering issues across email clients
- •Double-check escaped output before inserting into HTML attributes or JavaScript strings
When to Escape vs Unescape
- •Escape: Before displaying user input, storing code examples, or sending HTML via APIs
- •Unescape: When reading data from legacy systems or converting escaped content back to readable text
- •Numeric entities ({) are more universal than named entities (©) but less readable
- •Always validate and sanitize HTML after unescaping to prevent injection attacks
- •Use escape for inline code documentation and technical content display
Pro Tips
- •This tool supports 60+ extended HTML entities including currency, copyright, and math symbols
- •Both named entities (©) and numeric entities (©) are supported for unescaping
- •Preview mode lets you see how escaped HTML renders in real-time
- •Use escape to safely display code snippets in blog posts and documentation
Most Popular
Escape for user input sanitization, unescape for legacy data migration
When to Use This Tool
Escape user-generated content before displaying it on web pages to prevent Cross-Site Scripting (XSS) attacks. Converting characters like <, >, and & to HTML entities ensures that malicious scripts won't execute, keeping your application secure.
Display HTML, XML, or code examples on websites, blogs, or documentation without the browser interpreting them as actual code. Escaped code snippets appear as readable text instead of being rendered, perfect for tutorials and technical documentation.
Create safe email templates by escaping special characters that might cause rendering issues across different email clients. Ensure copyright symbols, trademarks, and special punctuation display correctly in all email platforms.
Unescape HTML entities from legacy databases, CMS exports, or API responses to restore original text formatting. Convert escaped content back to readable characters for data processing, analysis, or re-importing into modern systems.
How It Works
Paste your HTML code, text with special characters, or escaped entities into the input field
Click 'Escape' to convert special characters (&, <, >, ", ©, ™, etc.) to HTML entities
Or click 'Unescape' to convert HTML entities back to their original characters
The tool supports 60+ extended entities including currency symbols, copyright marks, and mathematical operators
Use 'Show Preview' to see how the escaped/unescaped HTML will render in a browser
Copy the output to clipboard or download it as an HTML file for use in your project
100% Private
Files never leave your device. All processing happens locally in your browser.
Lightning Fast
Powered by Pure JavaScript for optimal performance on modern browsers.
Secure
No data collection, no tracking, no sign-up required.
Frequently Asked Questions
What's the difference between escape and unescape?
Escape converts special characters (like <, >, &) into HTML entities (like <, >, &) so they display as text instead of being interpreted as HTML. Unescape does the reverse: it converts HTML entities back to their original characters. Use escape to safely display code or prevent XSS attacks, and unescape to restore readable text from encoded content.
Does this tool prevent XSS attacks?
Yes! Escaping HTML is a critical defense against Cross-Site Scripting (XSS) attacks. When you escape user input before displaying it, malicious scripts can't execute because characters like < and > are converted to safe entities (< and >). However, escaping is just one layer of security—always combine it with other security measures like Content Security Policy (CSP).
What are extended HTML entities?
Extended entities go beyond basic HTML entities (<, >, &) to include special characters like © (copyright), ® (registered trademark), € (euro), — (em dash), and mathematical symbols. This tool supports 60+ extended entities, ensuring special characters display correctly across all browsers and platforms.
Can I unescape numeric entities like ©?
Absolutely! This tool supports both named entities (©) and numeric entities (© for decimal, © for hexadecimal). When unescaping, all three formats are recognized and converted back to their original characters (©). Numeric entities are more universal but less human-readable.
Is the preview mode safe to use?
The preview mode shows how HTML will render in a browser using React's dangerouslySetInnerHTML. While safe for your own content, be cautious when previewing untrusted or user-generated HTML, as it could contain malicious scripts. The preview is isolated within the tool and won't affect your page, but always validate content first.
When should I use HTML escaping in my projects?
Use HTML escaping whenever displaying user-generated content (comments, posts, profiles), showing code examples in tutorials, storing HTML snippets in databases, or sending HTML via APIs. It's essential for security, preventing XSS vulnerabilities, and ensuring special characters display correctly without breaking your page layout.