What is HTML escaping?

Converting special chars ( , &, ", ') to entities (<, >, &, etc.) for safe display.

Cross-Site Scripting. Attack that injects malicious scripts. Escape user input before embedding in HTML.

Which chars need escaping?

Five: , &, ", '. Convert to <, >, &, ", '. " and ' critical in attributes.

HTML escape vs URL encode?

HTML escape: < → < (for display). URL encode: space → %20 (for URLs). Different purposes; sometimes both needed.

How to use the HTML escape tool?

Enter text and click Escape to convert to entity references, or Unescape to convert back. Useful for XSS prevention.

How to display user input safely?

Escape it with this tool before embedding in HTML. <script> is displayed as text and never executed.

Does HTML escaping send my data?

No. Everything runs in your browser. Your input is never sent to a server.

How to escape HTML inside JSON?

Escape the JSON values that contain HTML characters with this tool so they can be displayed safely.

How to check template engine output?

Inspect the escaped strings with this tool to verify they were converted correctly.

Convert & to &. Using & as-is can be interpreted as the start of an entity reference and break the display.

Is HTML Escape/Unescape free?

Free to use, no sign-up required.

Is data sent to a server?

Input is processed locally in your browser—nothing is sent to our servers.

Tested on recent Chrome, Edge, Firefox, and Safari.

Core features work offline after the first load.

vs CLI or desktop apps?

HTML Escape/Unescape is an install-free online alternative to CLI or desktop apps.

Example: → <script>, & → &, "test" → "test"

HTML escape and unescape, XSS prevention, Safe user input display

How is this different from similar tools?

HTML Escape/Unescape runs in the browser with no install—ideal for quick checks before heavier CLI or IDE workflows.

html escape, html entity encode, html escape online, html special characters, escape html, xss escape

Tools

HTML Escape/Unescape

Escape and unescape HTML special chars. XSS prevention, text display.

Data is never sent to the server. Everything runs locally in your browser. Safe for sensitive information.

About this tool

This tool escapes and unescapes HTML special chars in one click. Three features: 1) Escape to < > & etc., unescape to restore, 2) XSS prevention and safe user input display, 3) All processing in browser—no data sent to server.

User registration form input displayed as-is broke the layout because it was interpreted as HTML tags! Escaping special characters is the very basics of XSS (cross-site scripting) protection in web development. With this tool, paste the target string and it instantly converts it to safe characters for display. You can also unescape an escaped string back to readable text with one click.

Input

Output

Usage

Enter text in the input field
Click Escape for entity refs or Unescape to restore
Use for XSS prevention when displaying user input safely

When to use

XSS prevention when displaying user input, escaping HTML in JSON, template output check.

Tools

About this tool

Tool interface

Usage

When to use

Examples