Escape HTML entities
Converts characters such as <, > and & into HTML entities (or back), and doubles as a searchable reference table of common HTML character entities.
Escape or unescape HTML entities (turn <, >, &, " and ' into their HTML form) and look up common characters — quotes, dashes, currency, math and Greek symbols — in a searchable entity reference table.
Steps and notes
What is Escape HTML entities?
Two jobs in one page. The escape/unescape boxes handle the five characters that break markup: & < > " and ' are what &, <, >, a double quote and an apostrophe turn into, and the reverse pass puts them back — the scope is deliberately the minimal set that stops a string breaking out of an attribute or text node, not a full conversion (named entities like é pass through untouched). Below that sits a searchable reference of common HTML character entities — quotation marks, dashes, currency and math symbols, Greek letters — each row showing the character with its named, decimal (&#NNN;) and hex (&#xNN;) forms, so when you only need "what is the entity for an em dash" you look it up rather than round-tripping a string.
- Paste the original text, then click escape or unescape and copy the result
- Or use the reference table below: search by character, entity name or meaning
- Each table row gives the character with its named, decimal and hex forms
- Only & < > " and ' are converted by the escape box — named and numeric entities pass through unchanged.
- Escaping already-escaped text produces &amp;amp; — the classic double-escape bug, which this tool makes easy to spot.
- Escaping is not sanitising: it stops markup being broken, it does not make untrusted HTML safe to render.
- The reference table lists ~38 common named entities with their decimal and hex forms, so you can look up a character instead of converting a whole string.
Frequently asked questions
- When must I escape HTML?
- Whenever untrusted text becomes part of markup — comments, form values, rich-text imports. Skipping it is how XSS happens; escaping turns a payload into visible text.
- How do I write an em dash or © as an entity?
- Look it up in the reference table on this page: — for the em dash, © for copyright. Each entry also gives the decimal and hex numeric forms (— / — and © / ©), which you can use when a named entity is not supported.
- What is the difference between named and numeric entities?
- Named ones (&, <) are readable; numeric ones (&, &) work for every character, including those without a name. Both decode to the same character, and the reference table shows the three forms side by side.
- Why does & appear inside URLs?
- An ampersand that separates query parameters is itself a live entity, so escaping it as & is the correct encoding for HTML attribute or text contexts — but the raw & is what the server parses. Escape for the document, not for the request line.
Category: Web
URL & encoding workflow
URL Encoder & Decoder — Percent-Encoding, encodeURIComponent Pitfalls → URL parser → Outlook SafeLink Decoder → Slugify string → Escape HTML entities