"category": "dev-utility",

HTML Escape Tool

"tldr": Paste text or code and get it HTML-escaped - <, >, &, and quotes converted to entities so it displays instead of rendering.

Convert the five HTML-significant characters into entities: < to <, > to >, & to &, and both quote styles to " / '. The escaped text displays literally in a browser instead of being interpreted as markup.

{"text": "html entities"}

Two jobs, one tool: displaying code snippets inside HTML (a <div> example that should be read, not rendered), and the security side - unescaped user input placed into HTML is precisely what XSS is. This escaping is the display fix; for user input, do it server-side with your framework, every time.

How to escape HTML

1Paste the text - code samples, user content, anything with < > & or quotes.
2The five special characters become entities; everything else passes through.
3Paste the result into your HTML - it will display exactly as written.
4Reverse it anytime with our HTML Unescape tool.

Convert Text to HTML entities in code

JavaScript

const escapeHtml = (s) =>
  s.replace(/[&<>"']/g, (c) =>
    ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]
  );

Python

import html

html.escape('<b>Tom & Jerry</b>')  # '&lt;b&gt;Tom &amp; Jerry&lt;/b&gt;'

Frequently asked questions

Is escaping & really necessary?

Yes, and skipping it is the most common mistake: an unescaped & starts an entity, so "Tom & Jerry" can render unpredictably, and "AT&T" in an attribute can break parsing. Escape & first (this tool does) or you double-escape the others into &lt;.

Does this protect against XSS?

It is the right escaping for HTML *content* context, but real XSS defense must happen server-side/framework-side at output time - React, Django, and Rails all escape by default. Attribute, URL, and JavaScript contexts each need their own escaping; a paste tool is for snippets, not a security layer.

Why ' instead of ' for the apostrophe?

' is XML - it was not defined in HTML 4, so very old parsers ignore it. The numeric ' works in every HTML version ever shipped, which is why serializers standardize on it.

Last updated: July 30, 2026

You might also need

Free and in-browser, like everything on JSON Console. Browse all tools →

HTML UnescapePaste text full of &, <, — and read it as plain text JSON EscapePaste any text and get a valid JSON string literal URL EncodePaste text and get it percent-encoded for safe use in URLs URL DecodePaste a percent-encoded URL or parameter and read it as plain text Base64 EncodePaste any text and get Base64 Base64 DecodePaste Base64 and read it as text Markdown to HTMLPaste Markdown and get clean HTML Case ConverterPaste identifiers (one per line) and get every casing at once: camelCase, PascalCase, snake_case, kebab-cas...UUID GeneratorGenerate up to 1,000 UUIDs at once