HTML Escape / Unescape
Escape characters for use in HTML elements/attributes or unescape them.
Input Text
Result
About HTML Character Entity Escaping & XSS Protection
HTML Escaping is the process of converting reserved characters in HTML syntax into their corresponding character entity references (e.g., converting < into <). This prevents browsers from interpreting raw user-supplied data as executable HTML elements, scripts, or attributes.
The 5 Core Reserved HTML Entities
| Character | Named Entity | Decimal Code | Security Purpose |
|---|---|---|---|
& |
& |
& |
Prevents entity ambiguity |
< |
< |
< |
Prevents opening HTML tags |
> |
> |
> |
Prevents closing HTML tags |
" |
" |
" |
Prevents attribute escaping in attr="..." |
' |
' / ' |
' |
Prevents attribute escaping in attr='...' |
Key Use Cases for Web Developers
- Cross-Site Scripting (XSS) Mitigation: Neutralizing malicious user inputs (like comments, usernames, or search queries) before displaying them on web pages.
- Rendering Code Snippets: Displaying raw HTML, JSX, or XML code inside
<pre><code>blocks on programming blogs and documentation portals. - Data Serialization in Form Attributes: Safely setting values in
value="..."attributes without quote collisions.
Frequently Asked Questions (FAQ)
Why must the ampersand (&) always be escaped first?
If you escape < to < first, and then escape ampersands, < will become corrupted into &lt;. The ampersand must always be converted first when encoding, and last when decoding.
Does HTML escaping alter formatting or whitespace?
No. Standard HTML escaping only targets reserved syntax delimiters. Spaces, tabs, and newlines remain intact.