HTML / JavaScript String Escape & Unescape
Escape your text as HTML special characters (& < > " ') or convert character references back to the original text. Choose "JS String Escape" to embed the text inside a JavaScript string literal instead. Need to convert a string for use in a URL? Try the URL Encoder/Decoder.
🔒 Runs in your browser · Your data is never sent to a server
Notes
- HTML escaping covers five characters: &, <, >, " and '. Everything else is output as is.
- Escaping alone is not a complete security measure. The correct handling depends on where the text is inserted: HTML body, attribute, JavaScript or URL.
- JS string escape is meant for embedding text in JavaScript string literals and is different from HTML entities.
Glossary
HTML escaping
Converting characters that have special meaning in HTML ("&", "<", ">", '"', and "'") into character references (such as & or <) so they display as literal text. It is also a common defense against XSS (cross-site scripting) when embedding user input into HTML.
JavaScript string escaping
Converting characters such as newlines, quotes, and backslashes into backslash-prefixed sequences (like \n or \") so they can safely appear inside a JavaScript string literal ('...' or "...").
FAQ
Why is HTML escaping necessary?
Characters such as "<" and "&" are interpreted as HTML. If user input is displayed without escaping, unintended tags can run, which leads to cross-site scripting (XSS).
Which characters are escaped?
Five characters are converted to their entities: ampersand (&), less-than (<), greater-than (>), double quote (") and single quote (').
When should I use JS string escape?
Use it to embed text in a JavaScript string literal. Line breaks and quotes are converted into backslash escape sequences.
Share this page