HTML Entity & String Escape
🔒 Runs in your browser
HTML entity escaping
When text is placed inside a web page, five characters carry structural meaning and must be
replaced with entities so a browser renders them literally instead of parsing them as markup:
& becomes &, < and >
become < and >, and the two quote characters become
" and '. Escaping user-controlled text this way is
the baseline defence against cross-site scripting. Unescape reverses it, and also resolves
decimal (A) and hexadecimal (A) numeric character
references back to the original character.
JS / JSON string escaping
To paste arbitrary text into a JavaScript or JSON string literal, characters that would break
the literal are backslash-escaped: the backslash itself, both quote styles, and the whitespace
controls (\n, \r, \t, and so on). Any remaining control
character is emitted as a \uXXXX sequence. Unescape decodes all of these, plus
\xHH and \u{…} code-point escapes. Everything runs in your
browser — no text is sent anywhere.
Frequently asked questions
What does HTML escaping do?
It replaces the five markup-significant characters — the ampersand, angle brackets and both quote styles — with HTML entities, so text renders literally instead of being parsed as markup.
Does unescape handle numeric entities?
Yes. It resolves named entities plus decimal (like A) and hexadecimal (like A) numeric character references back to the original character.
What is JS/JSON string escaping?
It backslash-escapes the characters that would break a JavaScript or JSON string literal: the backslash, both quote styles, newline, tab and other control characters (as \uXXXX).
Is my text uploaded anywhere?
No. All escaping and unescaping happens locally in your browser — nothing is sent to a server.