Options
Paste HTML or plain text and this tool escapes it as you type, turning characters like < and & into entities so code shows up on a web page instead of running. Switch to Unescape to decode entities back into normal characters, including double-escaped text like &lt;. You can choose which characters to escape, use named, decimal, or hex entities, and wrap the result in <pre><code> ready to paste into a blog post. Everything runs in your browser.
How to escape HTML
- Paste your code or text into the left pane, or open a file.
- Copy the escaped result from the right pane. It updates on every keystroke.
- To show code in a blog post or a WordPress Custom HTML block, turn on Wrap in <pre><code> so spacing and line breaks are kept.
- To go the other way, click Unescape and paste the escaped text.
HTML escape characters
Five characters have special meaning in HTML. Escaping them is enough to display any code safely as text.
| Character | Named entity | Decimal | Hex | Why it's escaped |
|---|---|---|---|---|
& | & | & | & | Starts every entity, so a bare & can be misread |
< | < | < | < | Starts a tag |
> | > | > | > | Ends a tag |
" | " | " | " | Ends a double-quoted attribute value |
' | ' | ' | ' | Ends a single-quoted attribute value |
The apostrophe uses ' instead of the named ', because older versions of HTML and some email clients don't recognize '.
Which escape setting to use
- & < > " ' is the safe default. It works for text between tags and inside attribute values.
- & < > only keeps quotes readable. Use it for text between tags, never inside an attribute.
- Those plus non-ASCII also turns accented letters, symbols, and emoji into entities like
éor😀. Use it when the page or email might not be saved as UTF-8. - Every symbol and punctuation mark escapes everything except letters, digits, and whitespace. It's mostly useful for obscuring an email address from simple scrapers.
Escaping vs. preventing XSS
Escaping user input before putting it in HTML is the main defense against cross-site scripting (XSS). Escaping is context-specific, though. Text placed inside a <script> block, a style attribute, or a URL like href="javascript:..." needs different handling, so in real applications use your framework's built-in escaping, such as React's JSX, Django and Jinja templates, or PHP's htmlspecialchars(), rather than escaping by hand.
Escaping HTML in code
| Language | Escape | Unescape |
|---|---|---|
| PHP | htmlspecialchars($s, ENT_QUOTES) | html_entity_decode($s) |
| Python | html.escape(s) | html.unescape(s) |
| JavaScript | Set textContent, or replace & < > " ' yourself | Parse with DOMParser and read textContent |
| Java | StringEscapeUtils.escapeHtml4(s) | StringEscapeUtils.unescapeHtml4(s) |
| C# | WebUtility.HtmlEncode(s) | WebUtility.HtmlDecode(s) |
Frequently asked questions
How do I show HTML code on a web page?
Escape it, then put the result inside <pre><code> tags. Turn on Wrap in <pre><code> and paste the output straight into your page or a WordPress Custom HTML block. The code appears as text instead of being rendered.
What does "double-escaped" mean?
Text that was escaped twice, so < became &lt;. It shows up as visible entity codes on a page. Unescape mode decodes it fully by default. When escaping, tick Don't double-escape entities so existing entities like © are left alone.
Which entities can it decode?
All of them. Unescaping uses your browser's own HTML parser, so it understands every named entity in the HTML standard, plus decimal and hex entities, even when the semicolon is missing.
Is the same as a space?
No. is a non-breaking space, which looks like a space but keeps two words on the same line. When unescaping, it's turned into a normal space by default. Untick that option to keep the non-breaking space character.
Is my code uploaded anywhere?
No. Escaping and unescaping happen in your browser, and nothing is sent to a server.