HTML Entities
Escape and unescape named and numeric entities
HTML gives four characters structural meaning — the angle brackets that open and close a tag, the ampersand that starts an entity, and the quotation marks that delimit an attribute. Any of those appearing in ordinary text has to be written as an entity so the parser treats it as content rather than markup. Escaping turns a less-than sign into <, an ampersand into &, and so on.
This matters beyond tidiness. Text that reaches a page unescaped is the mechanism behind cross-site scripting: a comment containing a script tag becomes a script tag. Escaping on output is the fix. This tool converts in both directions, using the full HTML5 named character reference set, so you can escape a snippet for safe display or unescape one you have found in a template or an RSS feed.
How to use it
- Paste the text or the escaped markupEscape takes readable text and produces entities; unescape takes entities and gives back the characters they stand for.
- Choose how aggressive the escaping should beThe minimal set covers only the characters that can break markup. The full set also escapes non-ASCII characters into numeric references, which is useful for documents that must survive a legacy encoding.
- Check the result before you paste itUnescaping is a good way to read a template that has been double-escaped: if you see &lt; the text has been through an escaper twice.
Frequently asked questions
Which characters actually have to be escaped?
In element content, only the less-than sign and the ampersand strictly need escaping. Inside an attribute value you must also escape whichever quote character delimits the attribute. Most encoders escape the greater-than sign as well, which is harmless and protects against parsers that are more forgiving than they should be.
What is the difference between a named and a numeric entity?
A named reference such as © uses a label from the HTML specification; a numeric one such as © or © addresses the Unicode code point directly. Numeric references always work, while named ones depend on the parser knowing the name. HTML5 defines over two thousand names, but only a handful are widely recognised by people reading source.
Does escaping HTML make my page safe from XSS?
Escaping on output is necessary but the context matters. Text going into element content needs HTML escaping; a value going into a JavaScript string, a URL attribute or a CSS block needs a different escaping rule entirely. Escaping HTML entities inside an href does nothing to stop a javascript: URL.
Why do I see &amp; in my output?
That is double escaping: an ampersand was escaped to &, and then the result was escaped again, turning its own ampersand into &amp;. It happens when a framework escapes automatically and the value was already escaped by hand. Unescaping once here will show you which layer is doing the extra work.
Do I need entities for accented or non-Latin characters?
Not on a modern page. If your document declares UTF-8, you can write those characters directly and they will render correctly. Numeric references remain useful when the text has to pass through a system whose encoding you do not control, or when you want the source to stay pure ASCII.