Free tool

HTML escape & unescape.

Turn markup into text you can show on a page, or turn <p>-riddled text back into the markup it used to be. Named and numeric references both ways, quotes and non-ASCII optional, and a counter so you know when a double-escaped string is finally clean.

What gets escaped

• & first, always — escaping it last is the classic bug that turns < into < on the second pass.
• < and >, the two characters that start and end a tag.
• " and ' when Quotes is on, so the text is safe inside an attribute as well as in body text.
• Everything above ASCII when Non-ASCII is on — a named reference where one exists, — style otherwise. Emoji and other astral characters stay whole.
• Nothing else. Line breaks, tabs and ordinary letters pass through, so a diff against the original shows only what actually changed.

Escaping is not sanitizing

Escaped markup does not render, so it cannot execute — that is the whole point, and it is why showing user content as escaped text is safe. It is not a way to make untrusted HTML safe to render. If a report needs to render markup you did not write, it needs a sandbox: Comma renders every report inside an isolated iframe with no access to the page around it, which is how the sandbox works.

When the file should be a link

Half the reason people escape markup is to paste it into a chat window without it disappearing. Published as a report it stays markup: one URL that renders the same for everyone, comments anchored to the exact element they are about, and every re-publish kept as a revision you can diff. An agent can do the whole loop over the MCP server.

Questions

How do I escape HTML online?

Paste the markup into the editor on this page with Encode selected. The five characters that mean something to an HTML parser — & < > " ' — come back as entity references, so the browser prints them as text instead of treating them as tags. Copy the result, or download it as a file. Nothing installs and nothing uploads.

How do I unescape HTML?

Switch to Decode and paste the text that has &amp;lt;, &amp;amp; or &amp;#39; in it. Every named reference in the table and every numeric reference, decimal or hexadecimal, is resolved back to the character it stands for. Run Decode twice if the text was double-escaped — the counter tells you how many references are left.

Why does my page show &lt;p&gt; instead of a paragraph?

Something escaped the markup on the way in — usually a template that HTML-escapes by default, or a database field written through a form. The content is intact, just encoded one layer too many. Decode it here to confirm that is all that happened, then fix the layer that escaped it rather than storing the decoded copy back.

When should I escape quotes?

Whenever the text will sit inside an attribute, such as title="…" or alt="…". A bare double quote there ends the attribute early and everything after it is parsed as markup. In ordinary body text quotes are harmless, so the toggle exists — escaping them anyway is never wrong, only noisier.

What does the non-ASCII option do?

It escapes every character above ASCII — curly quotes, em dashes, accented letters, emoji — either as a named entity where one exists or as a numeric reference. Useful when the file will be served without a reliable charset header, or pasted into a system that mangles UTF-8. If the page declares <meta charset="utf-8"> you do not need it.

Is escaping the same as sanitizing?

No, and the difference matters. Escaping turns markup into text: nothing renders, so nothing executes. Sanitizing keeps the markup and removes the dangerous parts, which is a much harder problem. If you want user content shown as code, escape it. If you want it rendered, sanitize it with a real sanitizer — never with a find-and-replace.

Is my text uploaded anywhere?

No. Encoding and decoding run in your browser. The text only leaves your machine if you click “Get a shareable link” and publish it as a report.

Related: HTML formatter · HTML viewer · Image to Base64 · all free tools · report types