Escape &, <, >, " and ' into safe HTML entities, or turn entities back into characters, with instant two-way results in your browser.
Everything is processed locally in your browser. Your text never leaves your device.
Escape mode walks your text through five replacements in a fixed order: the ampersand is handled first (& → &), then <, >, the double quote (") and the single quote ('). Doing & first is what keeps the result correct — if you escaped < before &, the ampersands introduced by earlier replacements would be escaped a second time. Unescape mode goes the other way by handing your text to the browser's own HTML parser through a detached <textarea> element, so every named and numeric entity the parser knows comes back as a plain character.
<div> as visible text has to write <div> in its source, otherwise the browser consumes it as markup and the snippet disappears. Paste your snippet into Escape mode and you get the entity soup to embed — and a rendered page that shows the tags literally.<script> becomes live code — that is cross-site scripting. Escaping every special character on output turns such payloads into inert text like <script>, which is why output escaping is the default defense for rendered user content.&, A and A all decode back to their character, including HTML5 named entities without trailing semicolons. The parser resolves everything while the textarea stays detached from the document, so no scripts execute during decoding.No, and the difference matters for security. Escaping turns every special character into inert text, so no markup or script can survive — it is the right tool when you want to display arbitrary content as-is. Sanitizing keeps a safe subset of real HTML (paragraphs, links, bold) and removes the rest, which requires an allowlist parser and is far easier to get wrong. Use escaping by default; only reach for a vetted sanitizer when you truly need user-supplied formatting.
The five this encoder handles cover the dangerous set: & starts every entity, < opens tags, > closes them, and the quotes " and ' can break out of attribute values. Angle brackets are only fatal in text position, but quotes kill you in attributes, so escaping all five everywhere is the cheap, context-free rule that never fails.
Because escaping is literal: the & inside & is itself escaped into &amp;, so a browser now shows the text '&' instead of '&'. Escaping is one-way per pass — if you are not sure whether content is already escaped, Unescape until it stabilizes, then escape exactly once when rendering.
Yes. Unescape uses the browser's own HTML parser via a detached textarea element, which resolves the full standard set: named entities (<, , €), decimal references (é) and hexadecimal ones (é), including modern HTML5 named entities with or without the trailing semicolon.
No. Escaping and decoding are a few lines of vanilla JavaScript running in your browser, and the decoder uses a detached DOM node that is never attached to the page. Your text never leaves your device, with no account, no tracking and no network request involved.
If you just finished with HTML Entity Encoder/Decoder, the natural next steps are HTML Minifier, Code Minifier, Regular Expression Tester, or browse every tool in Daily Tools.