Escaping runs entirely in your browser — nothing is uploaded.
Escape and unescape HTML entities online, free. HTML escaping converts characters that the browser would treat as markup — <, >, &, ", ' — into their HTML entities so they render as literal text instead of becoming tags. This tool escapes text into HTML-safe entities, or unescapes entities back to characters, entirely in your browser, and is a core defence when displaying untrusted text.
Escaping the markup characters when you insert untrusted text into HTML is a core defence against cross-site scripting (XSS). 100% free, no registration, and complete privacy — everything runs locally in your browser, so your data never touches a server.
Converts <, >, &, " and ' to entities so untrusted text can't become live markup or scripts.
Turn text into HTML entities, or decode entities like <div> back to characters.
Runs locally as you type — no upload, no wait.
Your markup and content never leave your device.
Convert the markup characters to entities: < becomes <, > becomes >, & becomes &, " becomes " and ' becomes '. The browser then renders the literal characters instead of interpreting them as tags. Paste your snippet and click Escape.
Escaping these characters when you insert untrusted text into HTML is a core defence against cross-site scripting, because it stops user input from becoming live markup or scripts. Context matters though — values placed in attributes, URLs, or inline JavaScript need their own encoding, not just HTML-entity escaping.
' is an XML entity that was not part of HTML 4, so older browsers may not recognise it. The numeric reference ' works everywhere, so HTML escaping uses it. For XML output, use the XML Escape tool, which emits '.
No. All escaping and unescaping happen in your browser with JavaScript. Your markup and content never leave your device.
Paste text containing entities such as <div> and click Unescape. The tool turns & < > " and ' back into &, <, >, " and ', recovering the original characters.
We use cookies for analytics and personalized ads to help keep these tools free. Until you accept, ads stay non-personalized and analytics cookies are off. See our Privacy Policy.