Development

HTML Escape/Unescape

Convert special characters to HTML entities or revert entities to characters.

Carregando ferramenta...

How to use

  1. 1Paste the text and choose Escape or Unescape.
  2. 2Click Process.
  3. 3Copy the result.

About

Converts special characters into HTML entities (and back), avoiding conflicts and rendering issues.

What is HTML escaping and when to use it

HTML escaping converts special characters into safe entities so they are displayed as text instead of being interpreted as code. It is essential for showing source code on pages and preventing HTML injection.

Characters like <, >, &, and quotes have special meaning in HTML. To show them literally, you convert them into entities: < becomes &lt;, > becomes &gt;, and & becomes &amp;. Unescaping does the reverse.

Without escaping, text containing <script> would be interpreted by the browser as code, which could break the layout or open security holes. That is why any user-supplied content should be escaped before being displayed.

The tool is also useful for anyone writing tutorials or documentation who needs to show HTML tags as plain text, without the browser rendering them.

Examples

  • Escape: <div class="x"> → &lt;div class=&quot;x&quot;&gt;
  • Unescape: &amp;copy; → &copy;

Limitations

  • Escaping protects against HTML injection, but it does not replace other security practices like sanitization and validation.
  • Different contexts (HTML, attribute, JavaScript, URL) require specific escaping; the tool covers the HTML text context.

How to use HTML escaping

  1. 1Paste the text into the main field.
  2. 2Choose Escape or Unescape.
  3. 3Click Process and copy the result.

Frequently asked questions

What is the difference between escaping and sanitization?

Escaping converts characters so they are not interpreted as code. Sanitization removes or rewrites dangerous content. They are complementary techniques.

Which characters are escaped?

Mainly <, >, &, double quotes, and single quotes, which have special meaning in HTML.

Do I need to escape user text?

Yes, whenever displaying user-supplied content on a page, to avoid layout breaks and injection attacks.

Other tools

UUID Generator

Generate random UUIDs instantly.

JSON Formatter

Format and validate JSON with automatic indentation.

Base64 Encode/Decode

Encode and decode text in Base64.

URL Encode/Decode

Encode and decode URLs.

UTM Builder

Build and validate campaign URLs with UTM parameters.

JSON Minifier

Compact JSON by removing spaces.