Developer & Tech
HTML Entity Escaper & Unescaper
Enter your details
Runs in your browser
How to use it
Using the html entity escaper & unescaper
- 01
Paste your content
User comments, code samples, anything destined to appear inside HTML.
- 02
Pick escape or unescape
Escape before inserting into pages; unescape to recover readable text from entity-laden source.
- 03
Insert the result safely
Escaped output can no longer start tags or break attribute quoting.
Good to know
Why escaping prevents XSS
Cross-site scripting happens when attacker-controlled text is interpreted as markup. Escaping < and & strips that power: the browser renders the characters literally instead of building DOM nodes from them. It remains the single most reliable defense layer for user content.
Entity flavors you will meet
- Named; & < > "
- Decimal numeric; & '
- Hexadecimal numeric; & '
- This tool resolves all three when unescaping
How it's calculated
The math behind this calculator
& → & < → < > → > " → " ' → 'Escaping replaces the ampersand first, then angle brackets, double quotes and apostrophes with their entity forms; the minimal set required to render arbitrary text safely inside element content and attribute values.
Unescaping resolves common named entities plus numeric references in decimal (') and hexadecimal (') notation, leaving anything unrecognized untouched so information is never destroyed.
Assumptions & limitations
- Only the five essential characters are escaped (no exotic named entities).
- Unescape covers amp, lt, gt, quot, apos and numeric forms.
- Entities outside these sets pass through unchanged.
Worked example
The classic XSS probe <script> becomes harmless <script>; displayed literally by browsers instead of executed as markup.
FAQ
Frequently asked questions
- Do I need to escape apostrophes?
- Inside element text, no; but yes inside single-quoted attribute values. Tools like PHP’s htmlspecialchars default to escaping it, and we follow that safer convention.
- Why does & get escaped first?
- Order matters: escaping it last would double-encode the ampersands introduced by earlier replacements, producing &amp;-style messes.
- Is unescaping dangerous?
- The operation itself is pure text substitution. Danger arises only if unescaped output later lands in a page without being escaped again.
- Are emojis affected?
- Not at all; they are already valid text characters and pass through both directions untouched.
Keep exploring