HTML Escape / Unescape

Make any text safe to drop into HTML — or turn <div> back into a visible tag.

About this tool

Characters like <, > and & have special meaning in HTML. If user-generated text is inserted unescaped, it can break your layout or, worse, open the door to cross-site scripting (XSS). Escaping replaces the five sensitive characters with their entity equivalents so browsers display them literally.

How to use it

  1. Paste the text you want to make HTML-safe, or click Sample.
  2. Click Escape ▸ to encode, or paste encoded text and click ◂ Unescape.
  3. Use ⇅ Output → Input to check that a round-trip is lossless.

Good to know

  • The escape step converts & < > " and '; everything else is left as-is.
  • Unescaping decodes both named entities (&copy;, &nbsp;, …) and numeric ones (&#169;, &#x27;).
  • Escaping is one important layer of XSS defence — always combine it with context-appropriate output handling in your application.