Input
Result
The result will appear here.Your runs
Only runs that cost points are saved.
Sign in to keep a history of your runs.
Escaping the five characters that can break out of markup — & < > " ' — is what keeps user text from becoming user markup. This encodes them, and decodes named, decimal and hexadecimal references in the other direction, including the numeric references that emoji and rare scripts arrive as.
How it works
- Minimal mode escapes only the five characters that matter for correctness, keeping the output readable.
- Full mode escapes everything outside ASCII letters and digits, for contexts that cannot carry UTF-8.
- Decoding handles named, decimal and hex references, and leaves unrecognised ones untouched.
Where your data goes
Nowhere. This tool runs entirely in your browser: the text you paste is processed by the page and is never transmitted to a server or written to a log.
When a run costs points, a one-line summary is saved to your own history so you can find it again. The summary records the shape of the run — sizes, counts, the values you looked up — never the content you pasted.
What it costs
Free up to 50.0 KB per run without an account. Past that, a run costs 1 points and is saved to your history.
Points come from signing up, checking in daily, commenting and completing your profile.
See how points workCommon questions
- Is escaping enough to prevent XSS?
- Only for text in an HTML body. Inside an attribute, a script block, or a URL, the escaping rules are different, and in those contexts entity encoding alone is not sufficient. Use a framework's context-aware escaping for anything user-controlled.
- Why is different from a space?
- A non-breaking space prevents a line break and is not collapsed with adjacent whitespace. Copied out of a web page into code, it looks like a space and breaks parsing — which is why it is worth decoding text before debugging it.
- Do I need to escape every non-ASCII character?
- No. A page served as UTF-8 handles them directly, and escaping them makes the source harder to read. Full mode exists for legacy pipelines that cannot be trusted with encoding.
The open-source behind it
This tool is a self-contained implementation. mathiasbynens/he (MIT) does the same job as a library — if you need this behaviour inside your own program, start there rather than calling a web page.
mathiasbynens/heAlso known as
- html entity encode
- html decode
- escape html
- html entities converter
- unescape html