maratoolHTML Escape and Unescape Online
Convert HTML special characters to entities, or decode entities back to text. Both panes are editable and update each other as you type.
Decoding covers around 250 named entities plus every decimal © and hexadecimal © reference. An unrecognized name is left exactly as written rather than deleted, and is counted above.
What is HTML Escape and Unescape?
HTML escaping replaces characters that the parser would otherwise read as markup with character references. The five that matter are &, <, >, the double quote, and the apostrophe; each becomes a named entity such as & or a numeric reference such as '. Escaping is what lets you print a code sample, a query string, or user-supplied text inside a page without the browser treating it as a tag, and it is the first line of defense against cross-site scripting in HTML text and quoted attribute values. Unescaping goes the other way, turning named entities, decimal references, and hexadecimal references back into the characters they stand for.
How to use
- Paste raw HTML or plain text in the left pane to see the escaped version on the right.
- Paste entity-encoded text in the right pane to decode it back to readable characters.
- Tick the non-ASCII option to convert accents and emoji to numeric entities, then copy either side.
Frequently asked questions
Which characters must be escaped in HTML?
In element text you must escape the ampersand and the less-than sign; the greater-than sign is escaped by convention to avoid ambiguity. Inside an attribute value you must also escape whichever quote character delimits the attribute. Escaping all five of & < > double quote and apostrophe is the safe default and is what this tool does.
Does escaping HTML stop XSS?
It stops injection in HTML text and quoted attribute contexts, which covers most cases. It does not help inside a script block, a style block, an unquoted attribute, or a URL attribute such as href, where a javascript: value is still dangerous. Escape at the point of output, in the context of that output.
What is the difference between an entity, a decimal reference, and a hex reference?
They are three spellings of the same character. The copyright sign can be written as the named entity, as the decimal reference for code point 169, or as the hex reference for A9. Named entities are readable but only a fixed list exists; numeric references work for any code point. This tool decodes all three.
Is unescaping done with innerHTML?
No. Assigning untrusted text to innerHTML to let the browser decode entities also executes any script tag or onerror handler in that text. Decoding here uses a lookup table for named entities plus a regular expression for the numeric forms, so no markup is ever parsed or run.
Last updated
Powered by maratool