$ html-escape

HTML Entity Encoder / Decoder

Escape text for safe use in HTML, or decode entities like & and ' back to characters.

Encode all non-ASCII too

Input

Output

Ad slot

When to escape

Any user-supplied text placed into HTML must have < > & " \x27 escaped, otherwise it can break the page or inject scripts (XSS). Encoding turns <script> into <script>, which displays literally. Decoding does the reverse, including named entities like © and numeric ones like ©.