📋 Escape HTML

Convert HTML code to escaped format by converting special characters to their HTML entity equivalents. This tool is essential for developers embedding HTML in code, JSON, or displaying HTML as plain text.

Enter HTML or Text:

📌 Escaped HTML Output:

Type or paste HTML to see escaped version...

Characters: 0

💡 What is HTML Escaping? HTML escaping converts special characters to their safe HTML entity equivalents:

Character	Escaped Entity	Use Case
&	&	Display ampersand symbols
<	<	Display less-than symbols
>	>	Display greater-than symbols
"	"	Display quotes in attributes
'	'	Display apostrophes safely

📝 Examples:

Input (Original HTML):

<div class="container">Hello & Welcome</div>

Output (Escaped):

<div class="container">Hello & Welcome</div>

Input (With Quotes):

Output (Escaped):

📚 Use Cases:

Embed HTML in JavaScript or JSON code safely
Store HTML content in databases without interpretation
Display HTML code as text on web pages
Prevent XSS (Cross-Site Scripting) attacks
Create documentation or tutorials showing HTML examples
Generate code examples in blogs and articles
Create HTML email templates with escaped content

🔒 Security Note: Escaping HTML prevents browsers from interpreting HTML code as markup, which is crucial for security when displaying user-generated content.

The five characters it replaces

One regular expression matches the five characters that can change how a browser reads your markup, and swaps each for its entity in a single pass:

& -> &amp;    < -> &lt;    > -> &gt;
" -> &quot;   ' -> &#039;

<a href="x">Tom & Jerry</a>
&lt;a href=&quot;x&quot;&gt;Tom &amp; Jerry&lt;/a&gt;

The single pass is what keeps it correct. Replacing the ampersand in its own step, before or after the others, would rewrite the entities just produced and give you &lt; where you wanted <. Every other character is left exactly as it is, line breaks and tabs included, so the output is your text with five characters widened.

Where this escaping is enough

Text content and quoted attributes: yes. With both quote styles covered, the result is safe to drop between tags or inside a single- or double-quoted attribute value.
Unquoted attributes: no. A space, a backtick or an equals sign still ends the value there, and none of those are escaped. Quote your attributes.
Inside a script or style block: no. Those parse by different rules; JSON-encode data for JavaScript instead.
URLs: no. A query string needs percent-encoding, which is a different job.

Nothing is decoded on the way in, so text that is already escaped gets escaped again: paste &nbsp; and you get &amp;nbsp;. Escape once, at the point where the text is inserted into a page.

Frequently asked questions

Which characters have to be escaped in HTML?

Five: the ampersand, the two angle brackets, the double quote and the apostrophe. The ampersand has to be handled first, or the escaping of the other four gets mangled - which is why this tool does all five in one pass.

How do I display HTML code on a page instead of running it?

Escape it here, then paste the result inside a pre and code block. The browser turns each entity back into the character when it draws the page, so a reader sees the tags as text and the markup never executes.

Why does my text come out as &amp; with an extra amp?

Because it had already been escaped once. Escaping is not idempotent: every pass turns each ampersand into & again. Unescape it first, or take the text from its original source rather than from a page that already displays it.