HTML Escape
HTML Escape replaces ampersand, less-than, greater-than, double quote, and apostrophe with &, <, >, ", and '. It does not sanitize a complete HTML document, understand whether text will be placed in element content, an attribute, JavaScript, CSS, or a URL, or prevent every injection risk. Correct escaping must match the destination parsing context.
Runs locally — files stay on your deviceIs HTML escaping the same as sanitizing HTML?
No. This page encodes five characters in plain text but does not parse or allowlist markup.
Output context determines the required escaping
HTML character references keep certain characters from being interpreted as markup in common text or quoted-attribute contexts. Other embedded languages have different rules.
How it works
A single replacement pass maps each occurrence of &, <, >, double quote, and apostrophe to a fixed reference.
Key concepts
Ampersand first in effect
Existing entities are escaped too, which can cause double encoding.
Context remains external
The tool cannot see where the output will be inserted.
When to use it
- Display a short untrusted string as HTML text.
- Prepare a value for a simple quoted HTML example.
- Inspect the escaped form of five common characters.
When not to use it
- Do not use it for JavaScript, CSS, URL, or unquoted-attribute contexts.
- Do not call it an HTML sanitizer.
- Do not repeatedly escape already escaped text unless intended.
Worked examples
Markup-looking text
- Input
<b>Hello</b>- Expected output
<b>Hello</b>
Tags become visible text.
Quoted value
- Input
Ana & "Mia"- Expected output
Ana & "Mia"
Both characters are replaced.
Already escaped
- Input
<- Expected output
&lt;
The ampersand is escaped again.
Common mistakes
Using output inside script
HTML escaping is not JavaScript-string escaping. Correction: Use a context-specific encoder.
Calling it sanitization
No DOM policy or tag allowlist exists. Correction: Use a maintained sanitizer for allowed markup.
Double escaping
Existing references change. Correction: Track encoding state.
Best practices
- Prefer framework auto-escaping.
- Encode at the final output boundary.
- Use a distinct encoder for every parsing context.
Related operations and differences
HTML Unescape
Choose HTML Unescape when you need to decode HTML entities into characters.; use HTML Escape specifically for html escape.
Base64 Decoder
Choose Base64 Decoder when you need to decode Base64 into readable text.; use HTML Escape specifically for html escape.
Base64 Encoder
Choose Base64 Encoder when you need to encode text as Base64 in your browser.; use HTML Escape specifically for html escape.
Binary to Text
Choose Binary to Text when you need to decode 8-bit binary groups into text.; use HTML Escape specifically for html escape.
Hex to Text
Choose Hex to Text when you need to decode hexadecimal bytes into text.; use HTML Escape specifically for html escape.
Random Token Generator
Choose Random Token Generator when you need to generate a cryptographically secure random token.; use HTML Escape specifically for html escape.
Limitations and privacy
- Exactly five character mappings.
- No parsing, allowlist, context detection, DOM sanitization, Unicode normalization, or XSS guarantee.
The entered value is transformed locally in this browser and is not sent to the Toolbox server.
Copying or pasting sensitive output into another service is a separate disclosure decision.
Frequently asked questions
Are tags removed?
No, their delimiter characters are represented as text.
Is this safe for JavaScript?
No.
Are existing entities preserved?
No, their ampersands are escaped.
Does it modify line breaks?
No.