What it does
The HTML Entities tool escapes text so it can be shown safely inside HTML, and unescapes entities back to plain characters. You can escape only the five special characters or also turn non-ASCII characters into named or numeric entities.
How to use it
- Type or paste into Text / HTML to escape, or paste into Escaped HTML to unescape.
- Choose what to escape:
- Only & < > " ': the characters that have a meaning in HTML.
- Basic + non-ASCII as named: also
©→©,€→€and so on. - Basic + non-ASCII as numeric: non-ASCII as
&#NNNN;.
Example
| Input | Escaped |
|---|---|
<a href="x">Tom & Jerry</a> |
<a href="x">Tom & Jerry</a> |
© 2026 – 10 € (named) |
© 2026 – 10 € |
Good to know
- Escaping is how you show code examples on a web page, and how to stop text typed by users from being run as HTML.
- With UTF-8 pages, non-ASCII characters do not need escaping; the basic five are enough.
- Unescaping understands named, decimal and hex entities.
FAQ
What is the difference between ' and '?
Both are an apostrophe. ' works in every version of HTML; ' was not part of HTML 4.
Is escaping enough to prevent XSS? It is the right step for text placed between tags. Values placed in URLs, scripts or styles need their own encoding, which your framework's templating normally handles.