Why does the apostrophe become ' and not '?

The numeric form works everywhere, while ' was not defined in HTML 4 and some older parsers ignore it. The XML Escape tool writes ' because XML does define it.

What does Unescape do with <?

It decodes one level, so < becomes the text < and stops there. Run it a second time if the text was escaped twice and you want the angle bracket itself.

Is the escaped text safe inside an attribute value?

Yes for the characters handled here, because both double and single quotes are converted, so the result works inside either style of quoted attribute. Unquoted attributes and URLs in href or src need extra care.

Will it remove script tags from pasted markup?

No. It turns the tags into harmless text such as <script> but removes nothing. If you need cleaned HTML rather than displayable text, use a sanitizer built for that.

HTML Escape / Unescape

Q: What does Unescape do with &lt;?

It decodes one level, so &lt; becomes the text < and stops there. Run it a second time if the text was escaped twice and you want the angle bracket itself.

Q: Is the escaped text safe inside an attribute value?

Yes for the characters handled here, because both double and single quotes are converted, so the result works inside either style of quoted attribute. Unquoted attributes and URLs in href or src need extra care.

Q: Will it remove script tags from pasted markup?

No. It turns the tags into harmless text such as <script> but removes nothing. If you need cleaned HTML rather than displayable text, use a sanitizer built for that.

Escape or unescape HTML entities.

Loading…

About HTML Escape / Unescape

Showing a code sample, a user comment or a snippet full of angle brackets on a web page means turning every character the parser treats as markup into an entity first. Paste the text, keep Escape selected, and the five characters & < > " and ' come out as &, <, >, " and '. Flip to Unescape for the reverse: decimal and hex references plus a built-in list of common names are decoded once, so &lt; becomes < and not <.

Features

Escapes ampersands, angle brackets and both quote marks
Apostrophes become ' and double quotes become "
Decodes decimal and hex numeric references
Decodes one level only, so &lt; becomes <
Accented letters and emoji pass through untouched

Limitations

Unescape knows numeric references and a built-in list of common names only; any other name is left as written.
Escape converts just the five characters above, so non-ASCII characters are never turned into numeric references.
Escaping makes text safe to display as text; it does not strip tags or sanitize HTML.

How it works

Paste the text into the HTML Input panel.
Choose Escape to produce entities, or Unescape to decode them, with the toggle in the middle column.
Read the HTML Output panel, which updates as you type.
Select Copy Output to take the result, or Clear All to start again.

Example input

<script>alert("hi")</script> & "quotes" & 'apostrophes'

Frequently asked questions

: The numeric form works everywhere, while ' was not defined in HTML 4 and some older parsers ignore it. The XML Escape tool writes ' because XML does define it.
: It decodes one level, so &lt; becomes the text < and stops there. Run it a second time if the text was escaped twice and you want the angle bracket itself.
: Yes for the characters handled here, because both double and single quotes are converted, so the result works inside either style of quoted attribute. Unquoted attributes and URLs in href or src need extra care.
: No. It turns the tags into harmless text such as <script> but removes nothing. If you need cleaned HTML rather than displayable text, use a sanitizer built for that.