When must I escape HTML?

Whenever untrusted text becomes part of markup — comments, form values, rich-text imports. Skipping it is how XSS happens; escaping turns a payload into visible text.

How do I write an em dash or © as an entity?

Look it up in the reference table on this page: — for the em dash, © for copyright. Each entry also gives the decimal and hex numeric forms (— / — and © / ©), which you can use when a named entity is not supported.

What is the difference between named and numeric entities?

Named ones (&, <) are readable; numeric ones (&, &) work for every character, including those without a name. Both decode to the same character, and the reference table shows the three forms side by side.

Why does & appear inside URLs?

An ampersand that separates query parameters is itself a live entity, so escaping it as & is the correct encoding for HTML attribute or text contexts — but the raw & is what the server parses. Escape for the document, not for the request line.

Escape HTML entities — Guide

Q: What is the difference between named and numeric entities?

Named ones (&, <) are readable; numeric ones (&, &) work for every character, including those without a name. Both decode to the same character, and the reference table shows the three forms side by side.

Q: Why does & appear inside URLs?

An ampersand that separates query parameters is itself a live entity, so escaping it as & is the correct encoding for HTML attribute or text contexts — but the raw & is what the server parses. Escape for the document, not for the request line.

Escape or unescape HTML entities (turn <, >, &, " and ' into their HTML form) and look up common characters — quotes, dashes, currency, math and Greek symbols — in a searchable entity reference table.

What it is and when to use it

Two jobs in one page. The escape/unescape boxes handle the five characters that break markup: & < > " and ' are what &, <, >, a double quote and an apostrophe turn into, and the reverse pass puts them back — the scope is deliberately the minimal set that stops a string breaking out of an attribute or text node, not a full conversion (named entities like é pass through untouched). Below that sits a searchable reference of common HTML character entities — quotation marks, dashes, currency and math symbols, Greek letters — each row showing the character with its named, decimal (&#NNN;) and hex (&#xNN;) forms, so when you only need "what is the entity for an em dash" you look it up rather than round-tripping a string.

Converts characters such as <, > and & into HTML entities (or back), and doubles as a searchable reference table of common HTML character entities.

How to use it

Paste the original text, then click escape or unescape and copy the result
Or use the reference table below: search by character, entity name or meaning
Each table row gives the character with its named, decimal and hex forms

A worked example

Fill in sample text

<div class="box">Hello & "World"</div>

Copy this into the tool, or open Escape HTML entities

Things that trip people up

Only & < > " and ' are converted by the escape box — named and numeric entities pass through unchanged.
Escaping already-escaped text produces &amp;amp; — the classic double-escape bug, which this tool makes easy to spot.
Escaping is not sanitising: it stops markup being broken, it does not make untrusted HTML safe to render.
The reference table lists ~38 common named entities with their decimal and hex forms, so you can look up a character instead of converting a whole string.

Questions people ask

When must I escape HTML?: Whenever untrusted text becomes part of markup — comments, form values, rich-text imports. Skipping it is how XSS happens; escaping turns a payload into visible text.
How do I write an em dash or © as an entity?: Look it up in the reference table on this page: — for the em dash, © for copyright. Each entry also gives the decimal and hex numeric forms (— / — and © / ©), which you can use when a named entity is not supported.
What is the difference between named and numeric entities?: Named ones (&, <) are readable; numeric ones (&, &) work for every character, including those without a name. Both decode to the same character, and the reference table shows the three forms side by side.
Why does & appear inside URLs?: An ampersand that separates query parameters is itself a live entity, so escaping it as & is the correct encoding for HTML attribute or text contexts — but the raw & is what the server parses. Escape for the document, not for the request line.

Next steps

Open the Escape HTML entities tool

Spotted something wrong on this page? Tell us via Contact Us