HTML Escape / Unescape
Convert special HTML characters to their entity equivalents (<, >, &, ", ') or reverse the process. Escaping prevents browsers from interpreting angle brackets and ampersands as markup, which is essential when displaying user-generated content or embedding code snippets in HTML.
The unescape direction converts HTML entities back to their literal characters, useful when you've received entity-encoded content from a CMS, API, or database and need the raw text. Both named entities (&) and numeric entities (&) are handled.
All processing happens in your browser — no data is transmitted anywhere.
By The Paper Room Editorial Team — Developer Tools
Frequently asked questions
Which characters are escaped?▼
The five characters that have special meaning in HTML: < (to <), > (to >), & (to &), " (to "), and ' (to '). These are the characters required by the HTML specification to be escaped in content.
Does this handle all HTML entities when unescaping?▼
Yes. The unescape function handles named entities (like &, <, ), decimal numeric entities (&), and hexadecimal entities (&) — the full range of HTML character references.
When should I escape HTML?▼
Whenever you're inserting text into an HTML document and the text might contain angle brackets, ampersands, or quotes. This prevents XSS vulnerabilities and rendering bugs. Most templating engines do this automatically, but you may need it for manual HTML construction.