Displaying a code snippet on a blog
Before
`<div>` in the post rendered as an actual div
After
Escaped to `<div>` — displayed as text
Without escaping, the code broke the page layout. Every code blog needs this.
All Tools
HTML Escape / Unescape – Encode and Decode HTML
I built this because I kept seeing user-submitted content break layouts — a `<` in a comment would open a tag, an `&` in a URL would break. Escaping converts those characters into entities that display safely. And sometimes you need the reverse: reading encoded content back to see what it says.
100% free, no signup
Your files are processed in your browser and never uploaded to any server.
A note from me
Escaping is a security measure, not a decoration. If you display user input without escaping it, you're opening the door to XSS. This is one of the most common vulnerabilities in web apps. The rule is simple: escape on output, not on input. Store the raw text; escape when you render it. If you're escaping everything on input, your users can't search for their own content properly.
— Mirza Noman Baig
How to use this tool
- 1Pick Escape or Unescape.
- 2Paste your HTML, text, or encoded content.
- 3See the result instantly.
- 4Copy with one click.
Real results from testing
These are actual measurements from using this tool, not estimates.
Reading a scraped page
Before
Scraped content was full of `&` and `"`
After
Unescaped to actual and characters
Made the extracted text usable for search and analysis.
Safely displaying user input
Before
A comment with `&` broke the surrounding markup
After
Escaped before rendering — displayed correctly
Also prevents XSS. Two birds, one stone.
HTML Escape / Unescape features
Escape HTML characters
Convert <, >, &, and quotes into safe entities.
Unescape entities
Decode entities back into readable characters.
Prevents markup injection
Essential for displaying user-generated content safely.
Runs locally
Your content never leaves your browser.
Frequently asked questions
Is escaping enough to prevent XSS?+
It depends on context. HTML escaping is correct for HTML text content and attributes. For JavaScript contexts, URL contexts, or CSS contexts, different escaping rules apply.
What characters get escaped?+
The essentials: `<` becomes `<`, `>` becomes `>`, `&` becomes `&`, `"` becomes `"`, `'` becomes `'`.
Is my content uploaded?+
No. Everything runs in your browser. Nothing gets sent anywhere.
Should I escape on input or output?+
On output. Store the raw text in your database, and escape when you render it. Escaping on input makes search and editing harder.
Can it decode entities?+
Yes. Switch to Unescape mode and paste the encoded content.