HTML Escape / Unescape
Escape text for HTML or decode HTML entities (named and numeric) back to text, in your browser. Free, instant, nothing uploaded.
About this tool
Escape text for safe display inside HTML (< > & and quotes become entities), or decode the other direction: numeric references like € and the common named entities ( — … © and a few dozen more) turn back into real characters.
The unescape direction is the everyday one: scraped content, CMS exports, and email templates arrive full of entities, and decoding them is the first step to working with the actual text.
Common uses
- Show a code snippet inside an HTML page without it being parsed.
- Decode entity-encoded text from a scraper or CMS export.
- Escape user-provided strings before inserting them into markup.
Automate via API
The same conversion is available as a REST endpoint for scripts, pipelines, and backends:
curl -X POST https://payloadly.com/api/v1/tools/html-escape \ -H "Content-Type: text/plain" \ -H "X-Api-Key: YOUR_API_KEY" \ --data-binary @input.txt
Frequently asked questions
Is my data uploaded to a server?
No. This tool runs entirely in your browser using JavaScript, and there are no ads on the page. Nothing you paste or drop here is uploaded, logged, or stored, and you can verify that yourself: open your browser's developer tools and watch the Network tab while you convert (no requests leave the page), or disconnect from the internet after the page loads and keep working.
Is escaping enough to prevent XSS?
For text placed inside element content or quoted attributes, escaping these characters is the core defense. But context matters: URLs, inline scripts, and CSS need their own context-specific encoding, and your framework's templating (which usually escapes by default) should stay the first line of defense.
Why does the escape direction output ' instead of '?
' is XML; it was not defined in HTML 4, so very old parsers do not know it. The numeric form ' means the same apostrophe and works in every HTML version, so it is the conservative choice.
Is there a size limit or a fee?
The browser tool is free with no signup and comfortably handles files up to tens of megabytes (limited by your device's memory). For automated or bulk processing inside your own scripts and pipelines, use the paid REST API.
Related tools
Convert text case in your browser: uppercase, lowercase, title, sentence, camelCase, snake_case, kebab-case, and more. Free, instant.
Generate cron expressions from plain English or decode one into a schedule with its next 5 run times. Runs in your browser, free.
Generate Discord timestamp codes from any date. All 7 <t:unix:style> formats with previews; every reader sees their own timezone.
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes of text in your browser. Nothing leaves the page; ideal for checksums. Free, instant.