HTML Escape

HTML reserves a handful of characters for its own syntax — < and > delimit tags, & starts a character entity, and quote marks bound attribute values. When any of these appear in text that's meant to be displayed literally rather than parsed as markup, they have to be replaced with their entity equivalents: & becomes &amp;, < becomes &lt;, > becomes &gt;, " becomes &quot;, and ' becomes &#39;. This tool performs that substitution in either direction — escaping raw text for safe embedding in HTML, or unescaping entities back into their literal characters.

Escaping matters beyond just visual correctness. If user-supplied text is inserted into a page without escaping it first, a string like <script>alert(1)</script> would be parsed as an actual script tag by the browser rather than displayed as text — this is the root mechanism behind cross-site scripting (XSS) vulnerabilities. Escaping the five reserved characters neutralizes that by ensuring the browser renders them as visible text instead of markup.

Common uses include preparing code snippets or user comments for embedding in a web page, decoding entity-laden text copied from a browser's "view source," and cleaning up HTML exported from a CMS or RSS feed before pasting it somewhere else.

In HTML, < and > start tags, & starts an entity and quotes delimit attribute values. To display these characters literally, they are replaced with entities: &lt;, &gt;, &amp;, &quot;.

Escaping user-provided text before inserting it into a page is the core defense against cross-site scripting (XSS). Escape at output time, in the right context, using your framework's built-in escaping, and do not rely on this tool as a replacement.