When (and Why) to Escape HTML
Five characters carry structural meaning in HTML: & starts an entity, < and > delimit tags, and " / ' end attribute values. Any of them appearing in user text, code samples or data must be escaped — otherwise the browser interprets instead of displays, breaking layout at best and enabling XSS injection at worst. Decoding runs the other way: turn &eacute;-littered text from feeds, scrapes or logs back into readable characters, including decimal (©) and hex (©) forms.
For other escaping jobs, see the URL Encoder/Decoder (percent-encoding for links), Base64 Encoder (binary-safe transport) and the Markdown Previewer (which escapes its HTML output automatically).
Frequently Asked Questions
What are HTML entities and why do I need them?
Escape sequences that make HTML-special characters display as literal text: < becomes < so the browser doesn't read it as a tag. Escaping untrusted text is also the core defense against XSS.
Which characters must always be escaped?
& < > in content, plus " and ' inside attributes. With UTF-8 pages everything else (accents, emoji) may appear literally — numeric entities just make it encoding-proof.
Named vs numeric entities — which should I use?
Named (©) are readable but exist only for a fixed list; numeric (© / ©) work for every Unicode character. This tool outputs either style and decodes all three forms.
Does escaping HTML prevent XSS?
It neutralizes injected markup in HTML content and quoted attributes — the most common vector. Scripts, URLs, CSS and event-handler contexts need their own context-specific escaping.
Is my text uploaded anywhere?
No — encoding and decoding run entirely in your browser. Nothing is sent, stored or logged.