Skip to main content
SiteIndex
DeveloperReady to use

HTML Escape / Unescape

Escape HTML special characters into entities or unescape entities back into raw HTML text.

Guide

Interactive workspace

No account required
HTML Escape / Unescape

51 characters in · 51 characters out — the conversion updates live as you type.

Why escape? The XSS example

Inserted into a page unescaped, this user input would run as code:

<script>alert('XSS')</script>

Escaped, the browser displays it as harmless text instead:

&lt;script&gt;alert(&#039;XSS&#039;)&lt;/script&gt;
Copyable JavaScript snippets
escapeHtml
function escapeHtml(text) {
  return text
    .replace(/&/g, "&amp;")
    .replace(/</g, "&lt;")
    .replace(/>/g, "&gt;")
    .replace(/"/g, "&quot;")
    .replace(/'/g, "&#039;");
}
unescapeHtml
function unescapeHtml(text) {
  const textarea = document.createElement("textarea");
  textarea.innerHTML = text;
  return textarea.value;
}
Entity reference
CharacterNamedDecimalHexDescription
&&amp;&#38;&#x26;Ampersand — always escape this one first, or the other entities break
<&lt;&#60;&#x3C;Less-than sign — starts a tag if left raw
>&gt;&#62;&#x3E;Greater-than sign — closes a tag if left raw
"&quot;&#34;&#x22;Quotation mark — ends a double-quoted attribute value if left raw
'&apos;&#39;&#x27;Apostrophe — ends a single-quoted attribute value (&#039; is the widely compatible form)
␣&nbsp;&#160;&#xA0;Non-breaking space — renders as a space that cannot wrap or collapse
©&copy;&#169;&#xA9;Copyright sign
®&reg;&#174;&#xAE;Registered trademark sign
™&trade;&#8482;&#x2122;Trademark sign
€&euro;&#8364;&#x20AC;Euro sign

How to use it

  1. Paste the text or entity-encoded text.
  2. Choose Escape or Unescape.
  3. Review the output as text before embedding it in the appropriate HTML context.
What is HTML Escape / Unescape?

Escape HTML special characters into entities or unescape entities back into raw HTML text.

How it works

SiteIndex converts reserved characters such as <, >, &, and quotes into their HTML entity equivalents, or reverses the process to decode entities back into readable text, entirely in your browser.

Common uses
  • Safely embed user-generated text inside HTML without breaking markup.
  • Decode HTML entities copied from a web page or API response.
  • Prepare text snippets for safe inclusion in templates or emails.
Limitations
  • Escaping text is not general HTML sanitization or JavaScript/CSS/URL-context encoding.
  • Unescape produces raw characters; inserting that result as executable HTML can be unsafe.
Frequently asked questions
Is my text sent anywhere?
No. Escaping and unescaping both happen locally in your browser.

Related tools

JSON Formatter
Validate, format, minify, copy, and download JSON with a quick browser-based parser.
URL Encoder
Encode or decode URL strings and query parameter content securely in-browser.
Base64
Encode and decode UTF-8 text directly in your browser.
Markdown Preview
Turn markdown into rendered HTML preview with simple formatting controls for writing and documentation checks.
XML Formatter
Pretty-print and validate XML with readable indentation, cleanup, and error feedback.
OGP Tag Generator
Generate Open Graph and Twitter/X meta tags from a title, description, image, and URL.