Escaping runs entirely in your browser — nothing is uploaded.
When untrusted text is inserted into an HTML page, the markup characters must be converted to entities so the browser shows them literally instead of running them as tags or scripts. This is the front line against cross-site scripting (XSS), and it's also how you display code samples on a page. This tool escapes and unescapes in your browser — nothing is uploaded.
| Character | Entity |
|---|---|
& | & |
< | < |
> | > |
" | " |
' | ' (HTML-safe form) |
Entity escaping secures text placed in element content and quoted attributes. Values going into a URL, an inline <script>, or a CSS context need their own encoding — escaping the five characters is necessary but not sufficient in those positions.