HTML Escape / Unescape
Escape plain text for HTML body or quoted-attribute contexts, decode a documented entity set, or prepare standalone double-quoted JavaScript string content.
Tool code processes selected files and entered content in your browser and does not submit them to a TOOLGRID processing endpoint. TOOLGRID measures tool usage, not the content you enter.
Loading tool…
Browser-basedWhat this tool does
Escape HTML-sensitive characters with named, decimal, or hexadecimal references; decode the documented named set and Unicode numeric references with fail-safe invalid-scalar handling; or escape standalone double-quoted JavaScript string content. The tool does not execute supplied markup.
Unescape intentionally recognizes only &, <, >, ", ', ', , and decimal or hexadecimal numeric references. It preserves non-breaking space as U+00A0, substitutes U+FFFD for invalid numeric scalars, and leaves other named entities unchanged.
The JavaScript option produces only the contents of a standalone double-quoted string. It is not an inline <script>, HTML event-handler, CSS, or URL encoder; use a context-specific serializer and a strict Content Security Policy for those boundaries.
What you can do with this tool
Encode untrusted plain text for a known HTML body or quoted-attribute sink, then insert it through a text-oriented API. Rich HTML, URLs, styles, and executable contexts need their own validation or sanitization.
Application logs and many JSON APIs return HTML-escaped strings (<p> instead of <p>). Decode them to read the underlying content during debugging.
When writing technical docs that include code examples or HTML snippets, escape the HTML so the rendered docs show the markup as text instead of interpreting it as actual markup.
What to check before relying on the result
- Performance and maximum practical input size depend on browser memory, device speed, and the structure of the input.
- Review the generated result before replacing or publishing an original file.
How to use
- 1
Choose the destination context before pasting text: body, double-quoted attribute, single-quoted attribute, or standalone double-quoted JavaScript string content.
- 2
For HTML contexts, choose named, decimal, or hexadecimal references and review the exact escaped output.
- 3
Use Unescaped only for the documented entity set; unsupported named entities remain visible so the result never implies broader coverage.
- 4
Copy the required result and verify it again in the real destination context.
Use Cases
Encode untrusted plain text for a known HTML body or quoted-attribute sink, then insert it through a text-oriented API. Rich HTML, URLs, styles, and executable contexts need their own validation or sanitization.
Application logs and many JSON APIs return HTML-escaped strings (<p> instead of <p>). Decode them to read the underlying content during debugging.
When writing technical docs that include code examples or HTML snippets, escape the HTML so the rendered docs show the markup as text instead of interpreting it as actual markup.
Inspect the supported named and numeric references in CMS exports while leaving unknown named entities unchanged for explicit review.
Tips & Tricks
HTML body text and quoted attributes have different delimiter rules. The JavaScript mode is limited to standalone double-quoted string content and is not suitable for an inline <script>, an event handler, CSS, or a URL.
Unescape handles amp, lt, gt, quot, apos, #39, and nbsp plus numeric references. Other named references such as © remain unchanged instead of being silently misrepresented as supported.
Valid decimal and hexadecimal references decode to Unicode characters, including astral characters. U+0000, surrogate values, values above U+10FFFF, and numeric overflow decode to U+FFFD rather than throwing.
Escaping converts dangerous characters to safe entities — fine for plain-text contexts. Sanitization removes or rewrites whole tags (e.g., dropping <script> while keeping <p>). For rich-text user input where some HTML must be preserved, use a sanitizer like DOMPurify, not just escape.
FAQ
Does this run entirely in my browser?
Escape and unescape use deterministic string transformations and never parse the input as live markup. Text-file editing is most responsive at 5 MB or less, and files above the 50 MB hard limit are rejected. Tool code processes selected files and entered content in your browser and does not submit them to a TOOLGRID processing endpoint. Browser-local processing avoids a TOOLGRID upload path, but it is not a blanket security guarantee.
Which HTML entities does it cover?
Escape covers ampersand, less-than, greater-than, double quote, and apostrophe according to the selected HTML context. Unescape recognizes only &, <, >, ", ', ', , and semicolon-terminated decimal or hexadecimal numeric references; other named entities stay unchanged.
Is escaping alone enough to prevent XSS?
Only when the output is treated as plain text in the exact HTML body or quoted-attribute context selected. Escaping is not sanitization, URL validation, Trusted Types, or a substitute for safe DOM APIs and Content Security Policy.
What's the difference between escape and sanitize?
Escape preserves all input — it just makes potentially dangerous characters safe by converting them to entities. Sanitize removes content — it strips or rewrites whole tags and attributes that don't pass a whitelist. Use escape when you want to display plain text; sanitize when you want to allow some safe HTML.
Can I escape HTML for attribute values specifically?
Yes. Select the double-quoted or single-quoted attribute context so the active delimiter is encoded. The tool does not support unquoted attributes, event-handler attributes, style attributes, or URL validation.
Does it handle international characters?
Valid Unicode text passes through escape mode, and valid numeric references can decode BMP or astral characters. Invalid numeric scalars become U+FFFD, while remains the non-breaking U+00A0 character rather than an ordinary space.
Why does my escaped string still get rendered as HTML?
You're probably using innerHTML or dangerouslySetInnerHTML somewhere downstream — these bypass escaping. Switch to textContent (DOM) or pass the value as a child node in React/JSX, which handles escaping automatically.
Useful next steps
Open a nearby browser tool when you need to validate, convert, or reuse the result.