Ithy

HTML escape tool and common entity decoder

Escape text for display in an HTML text context, or decode a documented subset of named entities and valid numeric character references. Output remains plain text: the tool does not insert the entered markup into a live preview.

Free to use, with no sign-in. Inputs and results stay in this page and are not sent with the form. Download a result before leaving; this tool does not save your work.

Enter text or data

Worked result

The paragraph markup becomes escaped text rather than a live element.

  1. Replace ampersands first so newly introduced entities are not double-escaped.
  2. Escape <, >, double quotes and apostrophes.
  3. On decoding, replace recognized references once, without reparsing the result.

Show markup as visible text

To display a literal paragraph tag in an HTML text node, escape its delimiters and ampersand rather than interpreting the tag.

Input:
<p title="A&B">Hello</p>

Escaped:
&lt;p title=&quot;A&amp;B&quot;&gt;Hello&lt;/p&gt;

Decoding &amp;lt; once produces &lt;, not a less-than sign. Repeated decoding changes the result and can create dangerous surprises when data later reaches an HTML sink.

Encoding is specific to the output context

The encoder replaces &, <, >, double quote and apostrophe. The decoder supports amp, lt, gt, quot, apos, nbsp, copy, reg, trade and euro, plus valid decimal and hexadecimal numeric references ending in semicolons. Unknown named entities remain unchanged.

Numeric decoding requires a valid nonzero Unicode scalar value and rejects control-code references that HTML would reinterpret. This intentionally limited decoder is not a complete HTML parser. It does not decode all historical browser error-recovery rules.

Escapes: & → &amp;   < → &lt;   > → &gt;
Double quote → &quot;   Apostrophe → &#39;
Numeric examples: &#65; → A; &#x1F600; → 😀

Input limits and common mistakes

Limit: 200,000 input characters. Named references require their exact supported name and a semicolon. Invalid, control or surrogate numeric references cause an error. Unrecognized named references are left as written.

HTML text escaping is not a sanitizer for arbitrary HTML and does not make text safe in JavaScript, CSS, SQL or every attribute context. Use the framework’s context-aware escaping in an actual application. No input is rendered as markup or fetched as a resource here.

Questions about html escape and entity decoder

Does escaping sanitize a whole HTML document?

No. It turns selected characters into references. Sanitizing allowed markup requires a separate, context-aware policy and parser.

Why does an unfamiliar entity stay unchanged?

The decoder intentionally supports a stated subset rather than claiming to implement every named HTML entity.

Does decoding execute HTML?

No. Results are assigned as plain text. There is no live markup preview or navigation.

Sources and verification

These references explain the formulas or formats. The worked examples above were created for this tool and checked against independent calculations or format round trips. AI-assisted development does not imply a named human expert review.

Published 2026-10-23. Examples are illustrations, not measurements of a service or claims about search rankings.

Related tools

URL encode and decode

Percent-encode a URL component or decode UTF-8 percent escapes. Choose literal-plus or form-plus interpretation explicitly.

JSON formatter and validator

Validate and format JSON with two-space, four-space or compact output. Preserve numeric tokens, string escapes, key order and duplicate keys as written.

Text and UTF-8 byte counter

Count UTF-8 bytes, Unicode code points, UTF-16 units, grapheme clusters, lines and whitespace-separated words. Inspect the difference with emoji.

All calculators and developer tools · Source-checked guides · How Ithy checks sources