digitalaai.

HTML Escape / Unescape

Escape ampersands, angle brackets and quotes, or decode the five exact entity forms supported here. This is a text conversion, not a universal sanitizer or full entity decoder.

Choose whether to encode characters or decode entities

The HTML escape tool provides two separate operations on the supplied text. Escape HTML replaces five character types with entity notation, while Unescape HTML reverses five exact forms. Paste the input, select the intended button and inspect the separate output. The operation is useful when preparing literal markup for display in an appropriate text context, but it does not parse a document, remove tags or decide where the result will be inserted in another application.

Start by identifying the source format. A literal less-than sign is different from the text “<”, even when a browser can render one from the other in a particular context. Repeatedly converting without tracking that distinction can add or remove an encoding layer you did not intend. Keep the original and test a short example before using the result in documentation, a template or a message where exact punctuation and entity spelling matter.

Understand the five escape replacements

Escape first replaces ampersands, then less-than signs, greater-than signs, double quotes and apostrophes. The outputs are &, <, >, " and ' respectively. Ampersands are handled first so the ampersands introduced by later replacements are not immediately encoded again during the same pass. The order is part of the implementation and explains why one pass produces a different result from applying the entire operation repeatedly to an already encoded string.

For a simple example, “<b>Tea & coffee</b>” becomes an entity-encoded representation of the brackets and ampersand while preserving the letters and tag spelling as text. Spaces and line breaks are not deliberately changed. The output does not become a paragraph or a preview of bold text; it is the converted string in the output box. Copy the exact value needed for your destination instead of assuming that every editor will interpret entity notation the same way.

Check double encoding before running Escape again

If the input already contains “&lt;”, escaping it changes its ampersand and produces “&amp;lt;”. That is expected for a literal string containing an ampersand; the function does not detect whether the text was previously encoded for HTML. This can be useful when documenting the entity itself, but it can also be an unwanted extra layer when you only intended to display a single less-than sign in the destination.

Keep a record of which layer you are handling: raw text, encoded source or rendered text copied back from an application. Do not fix an apparent mismatch by clicking operations repeatedly until the preview looks familiar. Compare a small known sequence and inspect the actual saved destination value. An editor that decodes entities while pasting can make the visible result look correct even when the stored string differs from the one your template or export process expects.

Understand the exact unescape limits

Unescape recognizes the exact forms &lt;, &gt;, &quot;, &#039; and &amp;. It is not a full named-entity table or a general numeric-entity decoder. Alternate spellings such as &#39;, &#x27; and &apos; are not handled by these replacements. Case variations can also remain unchanged because the patterns are exact. Choose a full parser or decoder when the task requires comprehensive HTML entity support rather than these five narrow string substitutions.

The order decodes ampersands last. For “&amp;lt;”, one unescape pass yields “&lt;”, not a literal opening bracket. That reveals one layer and avoids repeatedly interpreting the newly exposed sequence within the same run. If another layer genuinely needs decoding, work from a reviewed sample and decide that explicitly. The tool does not determine the intended number of layers or protect you from changing literal documentation examples that should remain encoded in the final content.

Distinguish escaping from removing HTML markup

Escaping preserves the tag spelling as encoded text; it does not extract the visible words from a document. If the task is to turn “<p>Hello</p>” into “Hello”, use a text-extraction workflow and review its own limitations. If the task is to show the literal tag syntax to a reader, escaping may be appropriate. These are different transformations, and choosing the wrong one can leave unexpected markup or omit information you meant to explain.

Unescaping likewise does not sanitize a document or validate that markup is suitable to render. Decoded angle brackets can become active syntax if a later application inserts the result into an HTML sink. Decide how the destination will handle the string before using it. This page only performs replacements; the safety and correctness of a final integration depend on its actual context and the application's appropriate rendering or sanitization workflow, not on a general “unescape” label.

Use the correct output context

HTML text, HTML attributes, JavaScript, CSS and URLs have different syntactic rules. These five replacements are not a universal encoder for every one of those contexts. A string that is suitable as literal text in one location can be wrong in another. Use the encoding provided by your template or application for the specific destination instead of treating a copied output as a complete solution to every quoting and embedding requirement.

For documentation, compare the code source with the rendered example and confirm that the reader sees the intended characters once. For an application field, establish whether it expects plain text or an already encoded fragment before pasting. Mixing those conventions can cause double encoding or accidental interpretation. The tool does not inspect the destination, apply a content policy or choose which markup is allowed, so keep those integration decisions separate from the conversion result.

Verify multilingual text and spacing preservation

Letters, digits and symbols outside the five targeted types remain unchanged by the escape operation. That includes accented letters and Hindi text; this is not transliteration or Unicode normalization. It also does not trim outer spaces, collapse repeated whitespace or convert line breaks into HTML breaks. If the result looks differently spaced in a browser, investigate the destination's rendering rules rather than assuming the converter inserted or removed every visible gap.

Use a representative sample containing quotes, an ampersand and the actual script used in your content. Compare the input and output character by character where accuracy matters. A saved document can contain correct entities while its preview collapses ordinary spaces, and a plain-text editor can show the entity notation literally. Those display differences do not by themselves establish a conversion error. Keep the intended data format explicit when handing the result to another editor or developer.

Copy a fresh result and preserve the source

Each button reads the current input and writes the corresponding output. Editing the input does not automatically refresh the old result, so run the chosen operation again before copying. Clicking a button twice without moving the output back into the input simply repeats the same conversion from the same source. Select the checked output manually and inspect it in the destination to confirm the expected layer and format were retained.

Save important original strings outside the tool, especially when they contain deliberate entity examples or nested encoding. A simple successful sample confirms the replacement rule, not that a whole template is valid or secure. The useful outcome is the right character representation for a known context. Use that precise description when reporting the task instead of calling every escaped result sanitized HTML or every decoded result safe code ready for arbitrary rendering.

Frequently asked questions

Which characters does HTML escape replace?

It replaces ampersands, less-than and greater-than signs, double quotes and apostrophes with five corresponding entity forms.

Is HTML unescape a full entity decoder?

No. It recognizes only &lt;, &gt;, &quot;, &#039; and &amp; exactly as implemented.

Will &#39; or &#x27; decode here?

No. Those alternate apostrophe representations are outside the exact replacement patterns.

Why does &lt; become &amp;lt; when escaping?

The input ampersand is encoded too. The tool does not automatically recognize an already encoded layer.

What does one pass do to &amp;lt; when unescaping?

It produces &lt;. Ampersands are decoded last, so the newly exposed sequence is not decoded again in the same pass.

Does escaping remove tags and return visible words?

No. It preserves tag spelling as encoded text. Use an appropriate extraction tool for visible-word conversion.

Is this a universal XSS sanitizer?

No. Context-specific encoding, safe rendering and any necessary sanitization belong to the destination application.

Are spaces and line breaks normalized?

No. The replacements do not intentionally change whitespace.

Does changing the input refresh output immediately?

No. Select the intended operation again after editing.

Does clicking Escape twice automatically process the previous output?

No. Each action reads the input field. Move a reviewed result into input deliberately if another conversion layer is actually needed.

Related tools