Escape text for HTML or decode entities back — all 252 HTML 4 named references plus ', every numeric reference, invalid code points mapped to U+FFFD and counted, and HTML5-only names reported untouched instead of guessed at. Free, no sign-up — runs locally in your browser.
Why escaping matters
HTML gives five characters a second job: < and
> delimit tags, & starts an
entity reference, and the quotes delimit attribute values. The
moment text containing them is placed inside markup, those
characters stop being text and start being structure — a
user's <script> in a comment field is the
classic disaster, but the everyday version is quieter: a
product name with an ampersand ("Fish & Chips") breaking a
feed, a code sample that renders as the thing it describes
instead of describing it. Escaping is the translation that
makes text safe to carry inside markup; unescaping is reading
it back. Both directions live here, with the exact rules each
one follows written down below instead of implied.
How to use this tool
- Paste your text. For escaping, plain text or a code sample; for unescaping, markup or a fragment full of entities.
- For escaping: decide on quotes (on if the destination is an attribute value) and on how non-ASCII characters should be written. The defaults — quotes on, non-ASCII kept — suit UTF-8 pages.
- Press Escape or Unescape. Unescaping reports how many references of each kind it decoded — and lists any named reference it does not know, untouched, rather than guessing.
- Copy the result, or send it back to the input to reverse the operation and verify the round-trip.
What is covered — precisely
Named entities: the complete HTML 4 set of
252 names (Latin-1, symbols, Greek, punctuation — everything
from to ℵ)
plus ': 253 names. The HTML5-only
extended set is intentionally not covered; unknown names pass
through unchanged and are reported. Numeric
references: all of them, decimal and hex, any code
point, decoded as the code point written — with the HTML
error cases (0, surrogates, above U+10FFFF) mapped to U+FFFD
and counted, and without the HTML5 Windows-1252 remapping of
the 0x80–0x9F range. Escaping: &,
<, > always; quotes on request;
non-ASCII as-is, as named entities, or as numeric references,
by your choice. A trailing semicolon is required in every
reference, both ways.
Worked example
Escaping this line (quotes on, non-ASCII as named entities):
Tom & Jerry said "5 < 6" — © 1940
gives:
Tom & Jerry said "5 < 6" — © 1940
Unescaping that result decodes six named references
(&, <, two ", — and
©) back to exactly the original line — one layer off,
nothing more.
Frequently asked questions
Which entity set does the unescaper know?
All 252 named character references of HTML 4 — the set that runs from & and © through Α and ℵ — plus ', which HTML 4 omitted but XHTML and HTML5 define; 253 names in total. It also decodes every numeric reference, decimal (©) and hexadecimal (©), at any code point. What it deliberately does not cover is the much larger HTML5-only named set (things like ≂̸): those names pass through untouched and are listed in the result message as not recognised, rather than being silently dropped or mangled — so you can see exactly what your markup depends on.
Does a reference need its semicolon?
Yes, in both directions of this tool's contract. Browsers forgive a missing semicolon in some text contexts (© without ; often renders as ©), but that forgiveness is context-dependent error recovery, not the format. The unescaper here decodes only complete &name; / { / 😀 references and leaves partial ones as literal text — because when you are preparing text to embed somewhere strict (an XML file, a template, a database field), 'probably an entity' is not good enough.
Why did escaping turn my < into &lt;?
Because it must. Escaping is not idempotent: the input contained the four characters & l t ;, and the & among them is exactly what escaping exists to neutralise. If it had been left alone, the result would display as '<' — changing your text's meaning. Double-escaping bugs come from escaping text that was already escaped upstream; the fix is to escape exactly once, at the boundary where text becomes markup. Unescape here reverses precisely one layer.
What happens to invalid numeric references like �?
They decode to U+FFFD, the replacement character �, and the result message counts them. The HTML standard assigns U+FFFD to code point 0, to surrogates and to values above U+10FFFF — a document cannot contain those characters, so a reference to one is a broken reference, and � is how HTML says so. Decoding them to the literal control character instead would produce files many tools refuse to open.
Is € decoded as the Euro sign (€)?
No — it decodes to the control character U+0080, and this is a deliberate, stated deviation. The HTML5 specification remaps numeric references 0x80–0x9F to Windows-1252 characters (€ ‚ ƒ …) because legacy documents meant those. This tool treats a numeric reference as meaning its code point, which is what XML, JSON tooling and every non-HTML context expects. If you are unescaping for an HTML page specifically, be aware references in that range are the one place the two readings differ.
Should I escape quotes in text content?
In element text, quotes are harmless unescaped — only &, < and > are structural there. Inside an attribute value delimited by double quotes, a raw " ends the attribute early, so quotes matter there. The 'Escape quotes' option is on by default because text pasted into this tool so often ends up in an attribute (alt text, meta descriptions, JSON-ish templates); turn it off when you know the destination is pure text content and you want the more readable output.
Dev