EscapeHTMLEvery special character, safely escaped.
Paste raw text or markup and get perfectly escaped entities — or paste an entity string and get the original characters back. Named, decimal and hex styles, full Unicode coverage, zero uploads.
- 100% client-side — nothing uploaded
- Free, no sign-up
- Auto-detects direction
// Output appears here — start typing or paste on the left.A checkpoint for every character
Built for developers who render user input and for anyone who ships multilingual email.
Three Entity Styles
Named entities for readability, decimal for legacy mail systems, hex for URLs and JavaScript — switch styles with one click and compare instantly.
Unicode Lossless
Turn on the Non-ASCII option and Chinese, Arabic, Cyrillic or emoji become numeric code points like 你 — text survives any transport, UTF-8 or not.
XSS-Safe by Default
The five critical characters & < > " ' are escaped first, so injected markup becomes inert text before it ever reaches the DOM.
HTML entities cheat sheet
The five characters that must be escaped, in every style the tool supports.
&&&<<<>>>"""'''Frequently Asked Questions
How do I encode HTML entities?
Paste or type your text into the left pane. EscapeHTML encodes it instantly — ampersands, angle brackets and quotes become entities such as & < > ". Pick the Named, Decimal or Hex style in the toolbar, then click Copy Output.
How do I decode HTML entities back to text?
Paste the encoded string (for example "Tom & Jerry") into the input pane. Auto mode detects the entity pattern and decodes it to plain text immediately. You can also force decoding with the Encode / Decode switch.
What is the difference between named, decimal and hex entities?
Named entities use readable words like & and <. Decimal entities use the character's code point in base 10, like &. Hex entities use base 16 with an x, like &. All three render identically in browsers — hex is common in URLs and JavaScript, decimal in older email systems.
How does the auto-detect mode work?
Auto mode scans the input for entity patterns such as {, 你 or <. If entities outnumber the raw special characters, the input is treated as encoded text and is decoded; otherwise it is treated as raw text and is encoded.
How are non-ASCII characters like Chinese handled?
Enable the Non-ASCII option and every character above code point 127 — including Chinese, Japanese, Korean, Arabic and emoji — is converted to a numeric entity such as 你 for 你. This keeps multilingual text lossless across systems that are not UTF-8 safe, such as some email template engines.
Does escaping HTML prevent XSS attacks?
Encoding the five critical characters & < > " ' before rendering user input is the core defense against reflected and stored XSS: it turns active markup like <script> into inert text. Always escape on output in the context where the data will be rendered, and combine it with a Content Security Policy.
Is my text uploaded to a server?
No. The entire encoder and decoder runs in your browser with client-side JavaScript. Nothing you paste is transmitted, logged or stored, so the tool is safe for private source code, customer data and email templates.
Can I use entities in email templates?
Yes. Email clients are stricter than browsers — some strip or misread raw special characters. Encoding them as entities (and turning non-ASCII characters into numeric code points) keeps symbols, quotes and CJK text intact across Outlook, Gmail and Apple Mail.