About the HTML Escape
To show HTML source on a web page, inside a <pre> block or a blog post, the angle brackets and ampersands must be escaped or the browser will render them. This tool replaces &, <, >, " and ' with &, <, >, " and '. The numeric form is used for the apostrophe because ' is not defined in HTML 4.
Non-ASCII characters are valid in UTF-8 pages and are left alone by default. Tick the option to encode them as numeric entities if the destination is an ASCII-only system such as an old email template or a legacy CMS field.
Escaping is also the correct defence against injecting untrusted text into a page; templating engines do it automatically, and this tool shows what they produce. The HTML Unescape tool reverses it.
How to use
- Paste the text or code on the left.
- Tick "Also encode non-ASCII" if the destination cannot store UTF-8.
- Copy the escaped text and paste it into your HTML.
Common questions
- What is the difference between HTML escape and URL encode?
- HTML escaping makes text safe inside a page; URL encoding makes it safe inside a URL. They use different rules, and a value that goes into a link href may need both.
- Why is the apostrophe encoded as ' and not '?
- Because ' is an XML entity that older HTML parsers do not recognise. The numeric form works everywhere.
- Are line breaks converted to br tags?
- No. Line breaks are preserved as-is; wrap the text in a pre element if you need them shown.