How to escape or unescape HTML in 3 easy steps
- 1
Paste your text
Raw HTML to escape, or entity-encoded text to unescape.
- 2
Pick the direction
Escape to make it safe, or unescape to restore the original.
- 3
Copy the result
The converted output is ready to paste into your code or editor.
Why use the html escape / unescape tool from Super Utility Hub?
Inserting raw user input into HTML breaks layouts at best and enables XSS attacks at worst. Escaping converts dangerous characters — <, >, &, quotes, apostrophes — into safe entity codes that browsers render as plain text.
This tool escapes and unescapes in both directions, so you can prepare content for insertion or decode entity soup back into readable text.
- Processes everything in your browser — no upload servers involved
- Free forever with unlimited uses
- Works on Windows, macOS, Linux, Android and iOS
- No watermark or branding on your output, ever
Frequently asked questions
Which characters get escaped?
& becomes &, < becomes <, > becomes >, double quotes become ", and apostrophes become ' — the five that have meaning inside HTML.
Does escaping prevent XSS?
Yes, when applied in the right context. Escaping output is the first line of defense; sanitizing rich HTML is a stronger second layer.
Why is my entity text not rendering?
If the output is displayed inside a code block or textarea, entities are shown literally — that is expected. Paste into rendered HTML to see the decoded characters.