VoriTools

Escape and unescape HTML text

Paste HTML source or entity-encoded text: escape the six characters that break HTML text into character references, or decode references back into the characters they stand for. Both directions run in this page and nothing is uploaded.

Runs locally in your browser

How to escape and unescape HTML text

Paste markup or encoded text into the box. Escape HTML replaces the six characters that break HTML text (&, <, >, ", ' and the backtick) with character references; Unescape HTML turns character references back into the characters they stand for.

Both directions run inside this page: nothing is uploaded and the tool keeps working offline. The result panel shows exactly what Copy puts on the clipboard, and Clear empties the input and the result together.

  1. Paste the HTML source, the plain text or the entity-encoded text into the input box.
  2. Press Escape HTML to replace the six special characters, or Unescape HTML to decode character references.
  3. Check the direction before pressing again: escaping text that is already escaped escapes the ampersands a second time.
  4. Read the result, then press Copy. Clear resets both the textarea and the output panel.
  5. Continue in an editor or press HTML format when you want the markup reformatted rather than escaped.

What each button converts, and what stays unchanged

What Escape HTML converts

Exactly six characters change: & becomes &amp;, < becomes &lt;, > becomes &gt;, the double quote becomes &quot;, the apostrophe becomes &#x27; and the backtick becomes &#x60;. Accents, CJK text, emoji and line breaks are copied unchanged.

Escaping is not idempotent because the ampersand is part of every reference: escaping &amp; produces &amp;amp;. Run the escape once on the original text; to inspect an earlier result, use Unescape HTML on it first.

What Unescape HTML decodes

The page decodes character references the way a browser does: decimal and hexadecimal numeric references (&#39;, &#x27;, &#169;), named references such as &nbsp;, &hellip; or &copy;, and the legacy forms that are accepted without a semicolon, like &amp and &lt.

A name the browser does not know, such as &foo;, is left as written, and an invalid code point such as &#x110000; becomes the replacement character U+FFFD. Legacy prefixes are decoded even without the semicolon, exactly as in HTML: &notanentity; starts with &not and comes back as ¬anentity;. That is the browser's own behaviour, not a private table, so the page and a real parser agree.

Where it helps, and its limits

Typical uses: showing code snippets in documentation, escaping user text before it is placed into an HTML template, and decoding entities that arrive from an API or an email. The output is plain text, so it pastes into any editor.

The tool does not validate or reformat HTML structure, does not decode URL percent-encoding (%20) and does not touch JavaScript or JSON escapes such as \n. Very large inputs are still processed in the page, so the highlighting may take a moment.

Recent tools: