Which characters are escaped?

The five HTML special characters: & " and ' are escaped to & < > " and ' respectively. These are the minimum needed for safe HTML insertion.

What is the difference from HTML entity encoding?

HTML escape only handles the 5 special characters needed for safe HTML insertion, while HTML entity encoding can encode all non-ASCII characters as numeric entities (e.g. © → ©).

Does escaping prevent XSS?

Yes, when inserting untrusted text into HTML text content or attribute values. Escaping & " ' breaks out of tags and attributes. However, escaping alone is insufficient for URL attributes or JavaScript contexts.

Can I unescape entities?

Yes. Unescape mode converts & < > " ' and numeric entities (&#NN; / &#xNN;) back to characters. Unknown named entities are left as-is.

Why is ' escaped as ' instead of '?

' is not supported in older HTML4 browsers. ' (the numeric entity) is universally supported in both HTML and XHTML.

Is the & escaped first?

Yes. & is escaped first to avoid double-escaping. If < were escaped first, the & in < would be re-escaped to <, producing incorrect output.

Escape HTML

Escape or unescape HTML special characters online. Gratis, privado y 100% del lado del cliente.

Modo

Entrada

Probar un ejemplo:

Salida

Local only

Historial reciente

Sin historial aún

Uso

Escriba o pegue texto en el cuadro de entrada.
Select escape or unescape mode.
Copy the result.

Tareas que usan esta herramienta

Convertir HTML to JSX for React

JSX es HTML con JavaScript expressions. Convertir HTML a JSX por closing void etiquetas, converting clase a className, y style cadenas a objetos.

TAREA

Convertir HTML to Markdown

Convertir HTML content to Markdown for simpler editing, storage, or display in Markdown-aware systems. Handles headings, lists, links, images, and code blocks.

TAREA

Convertir Markdown to HTML

Renderizar Markdown (headings, lists, código blocks, tablas, links) en HTML para mostrar en browsers o email.

TAREA

Leer HTML entities en pasted texto

Turn & < ' y friends back en real caracteres — y know cuando NOT a decodificar.

TAREA

Codificar special characters for safe insertion into HTML

Escapar <, >, &, ", and ' in user-supplied text so it can be placed inside HTML without triggering XSS or breaking markup.

TAREA

Prevenir clickjacking attacks

Clickjacking embeds your site en un invisible iframe y tricks usuarios en clicking. Aprender X-Frame-Opciones y CSP frame-ancestors.

TAREA

Prevenir SQL Injection (SQLi) attacks

SQLi injects malicious SQL a través usuario entrada. Aprender parameterized queries, entrada validation, y el principio de least privilege.

TAREA

Prevenir XSS (Cross-Site Scripting) attacks

XSS injects malicious scripts en web páginas. Aprender entrada sanitization, salida codificación, y Content Seguridad Policy a prevent XSS.

TAREA

Usar el iframe sandbox attribute

El sandbox attribute restricts iframe capabilities, preventing malicious embedded content de accessing el parent página.

TAREA

Pipelines que usan esta herramienta

Escapar HTML y minificar

CANALIZACIÓN

Preguntas frecuentes

Which characters are escaped?: The five HTML special characters: & < > " and ' are escaped to their corresponding HTML entities.
What is the difference from HTML entity encoding?: HTML escape only handles the 5 special characters needed for safe HTML insertion, while HTML entity encoding can encode all non-ASCII characters as numeric entities.