HTML Escape Online (Live Special Characters & Entity Tool)

Sanitize and escape reserved HTML markup characters (&, <, >, ", ') into safe entity references. Render raw code snippets inside <pre><code> blocks and neutralize Cross-Site Scripting (XSS) vectors in real time.

How Do You Escape HTML Characters?

To escape HTML characters, replace the 5 reserved markup delimiters with safe entity references: replace & with &, < with <, > with >, double quotes (") with ", and single quotes (') with '.

Raw Code / HTML Input: 47 characters

Entity Encoding Format:

Named (<, >) Decimal (<) Hex (<)

Escape quotes for HTML attributes (" and ')

Escaped HTML Output: 6 entities escaped

The 5 Reserved Characters in HTML Architecture

The World Wide Web Consortium (W3C) HTML specification reserves five ASCII characters for document markup syntax. When these characters appear as raw literal text in an HTML document, the browser’s DOM parser interprets them as structural tags rather than content:

Ampersand (& → &): Initiates all entity references. An unescaped ampersand causes the browser to attempt reading subsequent letters as an entity code.
Less-Than (< → <): Opens HTML element tags (e.g., <div> or <script>). Raw less-than signs break markup rendering.
Greater-Than (> → >): Closes HTML element tags.
Double Quote (" → "): Wraps HTML attribute values. An unescaped quote inside an attribute like <input value="User "Text""> breaks the DOM attribute boundary.
Single Quote (' → '): Delimits alternate attribute wrappers.

HTML Entity Encoding Standards Reference Matrix

Literal Character	Character Name	Named Entity	Decimal Entity	Hex Entity
&	Ampersand	&	&	&
<	Less Than	<	<	<
>	Greater Than	>	>	>
"	Double Quote	"	"	"
'	Apostrophe / Single Quote	' or '	'	'

OWASP Context-Aware Escaping: Why HTML Escaping Has Limits

According to the OWASP XSS Prevention Guidelines, escaping HTML entities protects only specific contexts within a web page:

HTML Body Context (<div>USER_DATA</div>): Standard HTML escaping (converting < and >) provides 100% protection against script tag injection.
HTML Attribute Context (<input value="USER_DATA">): Escaping quotes (" and ') is mandatory. Without quote escaping, an attacker closes the attribute boundary and injects malicious event handlers (like onfocus=alert(1)).
JavaScript Execution Context (<script>var x = 'USER_DATA';</script>): HTML entity escaping provides ZERO security inside script blocks. The JavaScript runtime parses HTML entities before script execution. Script variables must use JSON serialization (JSON.stringify()) and backslash escaping.

Related Web Security & Encoding Utilities:

Full HTML Entity Converter Hub — Complete character reference table for named, decimal, and hex entities.
URL Percent-Encoding Converter — Safely encode URI query parameters under RFC 3986.
URL Decode Online — Decode percent-encoded URLs and parse parameters.
HTML Entity Encoding for XSS Defense — Security rules and context boundaries guide.
HTML Entities vs. URL Encoding Guide — Technical comparison of web encoding standards.

Frequently Asked Questions

Why is escaping the ampersand (&) required first?

Because all HTML entities begin with an ampersand (&), escaping other characters first will result in double-escaping. For example, if < becomes <, escaping ampersands afterward turns it into &lt;. Always escape & before any other character.

How does HTML escaping prevent Cross-Site Scripting (XSS)?

By replacing structural tags like <script> with <script>, the browser renders the code as literal text on screen rather than executing it as active JavaScript.

What is the difference between Named and Decimal entities?

Named entities use human-memorable text aliases (like < for less-than). Decimal entities reference the character's exact Unicode number (like <). Both render identically across modern web browsers.

Can this tool unescape HTML entities back to raw code?

Yes. Click the "Unescape" button to convert encoded entity strings (like & and ") back into raw literal characters (& and ").

Is my code or markup saved on a server?

No. All HTML parsing, character replacements, and entity conversions execute 100% locally inside your browser's runtime memory using JavaScript. No code snippets or text are transmitted over an HTTP network or logged to external servers.