Loading tool…
ToolWrenEscape characters like <, > and & into HTML entities so they display literally, or unescape entities back to plain text.
Loading tool…
HTML Entities is a free, private online tool that lets you escape HTML special characters or unescape entities back to text. It runs entirely in your browser, so nothing you enter is uploaded to a server.
Privacy: this tool runs entirely in your browser. Your input is never sent to, received by, or stored on any server — there are no uploads and no tracking of what you enter.
HTML entities are codes that represent characters with special meaning in HTML. For instance < renders as <, and & renders as &. They let you show those characters without the browser interpreting them as markup.
Escaping user-supplied text before inserting it into a page is a core defense against cross-site scripting (XSS). Converting <, >, &, " and ' to entities prevents the browser from running injected tags or scripts.
Decoding turns entities (named like © or numeric like ©) back into the characters they represent — handy when reading scraped or stored HTML.
&, <, >, " and '.HTML entities are special codes that represent characters which would otherwise be interpreted as markup or cannot be typed directly. They take the form &name; (named, like &) or &#number; (numeric). The browser turns the entity back into the character when it renders the page, letting you display symbols like < and & as literal text instead of treating them as tags.
<script> into harmless visible text. Unescaping does the reverse, decoding entities back into the characters they represent, which is useful when reading scraped HTML, email templates or data that was stored in escaped form. This tool does both directions.
The single most important use of HTML escaping is security. If you insert untrusted text — a username, a comment, a search term — directly into a page without escaping, an attacker can include <script> tags that run in your visitors' browsers. This is a cross-site scripting (XSS) attack. Escaping the five significant characters (& < > " ') neutralises the markup so it displays as text rather than executing.
Escaping is a straightforward character-by-character replacement of the five HTML-significant characters with their entities. For unescaping, this tool uses the browser's own HTML parser, which means it correctly resolves not just those five but the full range of named entities (like © for ©) and numeric entities (decimal © and hex ©) — exactly as a real browser would.
Escaping for HTML body content is the most common need, but it is not the whole story. Text placed inside an HTML attribute, a URL, a CSS value or a piece of JavaScript each requires its own escaping rules. For untrusted input in those contexts, lean on a vetted templating engine or sanitiser library. This tool covers the standard HTML-text case and runs entirely in your browser.