HTML escaping β five characters, and one trap on the way back
To a browser, < is not a character; it is the start of a tag. Showing a literal < on a page means writing < instead. Going that direction is a simple rule. Coming back is where text quietly changes into something you did not write.
A few characters are grammar in HTML. < opens a tag, & opens a character reference, and quotes delimit attribute values. To show one as content you have to say it is content rather than grammar, and the notation for that is a character reference β usually called an entity.
There are two common reasons to need it. Putting a code sample into an article, and displaying something a user typed. The second matters more: skip the escaping and somebody else's <script> runs on your page.
The five characters
A numeric reference uses the code point instead of a name; the result is identical.
| Character | Named | Numeric | Why |
|---|---|---|---|
| < | < | < | opens a tag |
| > | > | > | closes a tag |
| & | & | & | opens a reference |
| " | " | " | delimits an attribute |
| ' | ' | ' | delimits an attribute |
Replace & first or the output is wrong
Escaping the five characters one at a time makes the result depend on the order. Turn < into < first, then replace & with &, and the ampersand you just created is caught too: the output is &lt;, which renders as the literal text < rather than as a bracket.
So either & goes first, or β as here β the text is scanned once and each of the five characters is looked up in a table. The second approach cannot be got wrong by reordering.
For the same reason, escaping text that is already escaped produces &amp;. When the input already contains references, this tool says so. It does not decide for you, because a real ampersand is perfectly legitimate.
References decode without their semicolon
This is the trap on the way back. A character reference is supposed to end with a semicolon, but the HTML standard recognises about a hundred of them written without one, because pages from the nineties depended on it and still have to render.
So text that was never markup changes on its own.
When unescaping, this tool finds those fragments and shows what each one is about to become. It does not block them β you may well have wanted the Γ β but it makes sure a log file or a note does not get silently edited while you are converting it.
Fragments that change without a semicolon
| What you wrote | What comes back |
|---|---|
| Sales × 3 | Sales Γ 3 |
| Price £ 5 | Price Β£ 5 |
| © 2026 | Β© 2026 |
| ¬it | Β¬it |
| AT&T | AT&T (unchanged) |
Non-Latin characters do not need escaping
Older material sometimes writes every non-ASCII character as a numeric reference β ν as 한, for instance. That was a safe choice back when a document's encoding was not something you could rely on.
It is unnecessary now. In a UTF-8 document, any script and any emoji can be written directly. Converting them to numeric references makes the file roughly eight times larger for those characters and unreadable to a person. Escape the five grammar characters and leave the rest alone.
What goes wrong without escaping
- β’A <script> typed into a comment box runs in the browser of everyone who views the page. This is the most common web vulnerability there is.
- β’A quote in a product name ends the attribute early and the rest is parsed as markup.
- β’Everything after a < in body text disappears, because the browser read it as a tag and drew nothing.
- β’AT&T and similar text is mistaken for a character reference and comes out as an unexpected symbol.
Frequently asked questions
Why ' rather than '?
' was only added to HTML in version 5, so very old browsers and some XML tooling do not know it. The numeric ' works everywhere.
Does escaping prevent XSS?
For text inserted into the body, largely yes. Inside a <script> block, an event attribute, or a href="javascript:...", the rules are different and escaping is not enough β user input does not belong in those places.
Is the same as a space?
No. It is a non-breaking space, U+00A0, a distinct character. It arrives in text copied from the web and is a common reason a search for a phrase finds nothing. A Unicode text cleaner is the better tool for hunting those down.
Is anything I paste sent anywhere?
No. The conversion runs entirely in your browser.