HTML Escape / Unescape

Overview

• Converts HTML special characters (<, >, &, ", ') into safe character references such as &lt; that the browser will not interpret as markup (escape), or converts character references back into the original characters (unescape).
• Displaying user input as raw HTML can cause it to be interpreted as unintended tags, leading to XSS (cross-site scripting). Escaping is one of the basic countermeasures against this.
• The six entities &amp; &lt; &gt; &quot; &apos; and &#39; are supported.

Usage

1. Enter the HTML you want to escape, or the escaped string you want to unescape, into the text area.
2. Click the "Escape" or "Unescape" button.
3. The result is displayed below.

Example

<div class="box">Hello & "World"</div>

<div class="box">Hello & "World"</div>

Use Cases

• Escaping user-entered text before displaying it on screen, so it is not interpreted as HTML
• Escaping a piece of HTML source so it can be shown as-is in documentation or a code example without the tags actually rendering
• Unescaping an already-escaped string received from another system or API to check the original text

FAQ

Notes

• Escaping is only one part of XSS defense and does not prevent every kind of attack on its own. Combine it with handling appropriate to the display context.
• The five characters &, <, >, ", and ' are converted. Other characters are left unchanged.
• Unescaping supports the six entities &amp; &lt; &gt; &quot; &apos; and &#39;. Other character references (such as &copy;) are left as-is.