HTML Escape / Unescape
HTML Escaping and Unescaping
You can convert special characters in HTML to character references, or convert character references back to their original characters.
Translation Result
What is HTML escaping?
HTML escaping is the process of replacing characters that have special meanings in HTML with character references. For example, the less-than sign is represented as <, the greater-than sign as >, and the ampersand as &. This prevents them from being interpreted as HTML tags, allowing source code and input strings to be displayed on the screen exactly as they are.
Unescaping does the opposite: it restores character references such as &lt; and &quot; to their original symbols. It is useful for checking escaped strings found in logs, templates, CMS content, email bodies, API responses, and more.
This tool does not send input data to the server; instead, it performs conversions entirely within the browser using JavaScript. Even when handling sensitive text, it is safer to use than conversion tools that involve network communication. However, when embedding the converted results into a web page, please verify that appropriate security measures are in place based on the framework you are using and the location where the content is displayed.
How to Use
- Paste the HTML or character references you want to convert into the input field.
- Select either "Escape HTML" or "Unescape HTML."
- Clicking "Convert" will automatically take you to the results section.
- If necessary, copy the result or swap the input and result to perform the inverse conversion.
Translation Example
<div class="message">Tom & Jerry</div>
↓
<div class="message">Tom & Jerry</div>Precautions for Use
- Escaping helps create strings for display, but it is not a substitute for SQL injection protection or URL encoding.
- If you insert an unescaped string directly into `innerHTML` or similar, there is a risk that scripts may be executed, depending on the content.
- This tool primarily converts &, <, >, double quotes, and single quotes.
Frequently Asked Questions
What is HTML escaping?
This involves converting symbols that have special meanings in HTML to character references so they can be safely displayed as text on the screen.
What is HTML unescaping?
This process converts character references such as &lt; and &amp; back to their original characters, < and &.
Will the entered data be sent to the server?
No. The conversion process is performed entirely by JavaScript within the browser.
Which characters will be converted?
This primarily converts the ampersand, less-than sign, greater-than sign, double quotes, and single quotes.
Can HTML tags be displayed directly on the screen?
Yes. If you use the escaped result, it won't be interpreted as a tag and will be displayed as a string.
Can this be used as an XSS countermeasure?
While this is one of the basic measures for displaying strings in HTML body content, appropriate measures must be taken for each output destination, such as attribute values, JavaScript, and URLs.
How is this different from URL encoding?
HTML escaping targets special characters in HTML, while URL encoding converts characters that cannot be used in URLs into percent-encoded form.
Will line breaks and spaces also be converted?
Standard line breaks and spaces will be preserved as-is. Please adjust line breaks in the HTML display separately using CSS, `br` tags, or other methods.
What happens if you double-escape it?
For example, the ampersand &lt; is converted again to &amp;lt;. Please be careful not to convert it more times than necessary.
Can I undo the conversion?
Yes. You can revert the change by swapping the input and the result and selecting the opposite conversion method.
Can you translate large amounts of text?
Conversion is possible within the limits of your browser's processing power and memory. Performance may be slow when handling very large datasets.