Escape Character HTML: Encode and Decode Entities

How to use the html escape

1. Paste the text or code into the box. The default example already contains every special character.
2. Pick Escape to encode, or Unescape to decode entities back into plain text.
3. When escaping, choose how to treat non-ASCII characters: keep them, or write them as decimal, hex or named entities.
4. Leave Escape quotes on for attribute values, or turn it off for plain text between tags, then copy the result.

What is an escape character in HTML?

HTML has no backslash escape. The escape character HTML uses is the ampersand: an entity starts with & and ends with ;, and the browser replaces it with the character it names. That is how you show a literal < in a page without the parser reading it as the start of a tag.

Five characters need escaping in most contexts. The ampersand starts entities, the less-than sign starts tags, the greater-than sign closes them, and the two quote characters end attribute values. Everything else can normally be written as it is when the page is served as UTF-8. In short, write the entity instead of the raw symbol.

HTML escape codes for the special characters

These html escape codes cover almost all everyday escaping. The same table applies when you escape characters html pages use in text nodes and in attribute values.

The apostrophe has a named form, ', but it was not part of HTML 4 and old parsers ignore it, so this tool writes '. Python's html.escape writes ' for the same character: both decode to the same apostrophe.

Escape or unescape non-ASCII text

If a page is served as UTF-8, accented letters and symbols can stay as they are. Entities for non-ASCII text matter when the file passes through a system that mangles encodings, or when you want the source to survive in plain ASCII, such as an email template or a legacy CMS field.

The three output styles encode the same code point three ways. For the euro sign (U+20AC): decimal €, hex € and named €. Characters above U+FFFF, such as emoji, are written as one reference for the whole code point, for example 😀, not as two surrogate halves. In named mode, any character without an HTML 4 name falls back to a decimal entity.

Decoding: named, decimal and hex references

Unescape mode understands the 252 named entities of HTML 4 plus ', decimal references like © and hex references like ©. Names are case-sensitive: É is a capital E with acute, é the lowercase one.

• Unknown names such as &foo; are left untouched.
• Reference �, values above U+10FFFF and surrogate halves decode to the replacement character U+FFFD.
• References 128 to 159 follow the Windows-1252 table the way browsers do, so € becomes the euro sign.

JavaScript escape HTML: doing it in code

To escape html javascript strings before inserting them with innerHTML, replace & first and the rest after, otherwise the ampersands you just added get escaped twice: s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;"). A safer habit is to assign to textContent, which never parses markup at all.

Escaping is context specific. The table above is right for text and quoted attributes. It is not enough inside a <script> block, inside a URL (use the URL encoder) or inside a CSS value. For JSON or JavaScript string literals use the string escape tool instead.

Common mistakes with HTML escaping

Using a backslash as the escape character HTML expects does nothing in markup, because the parser ignores it.

Double escaping is the usual bug: text that goes through the escaper twice turns & into & and shows literal entity text on the page. Escape once, at output time, and keep stored data raw.

The other mistake is skipping the ampersand because a string "has no entities". A URL like ?a=1&copy=2 contains &copy, which some browsers decode as the copyright sign even without a semicolon. Escaping every ampersand avoids that. For a broader encode and decode comparison see the HTML encoder and decoder.

Worked examples

Sources and references

• HTML Standard: named character references: the entity names
• Character reference, MDN Web Docs: what character references are