ToolzyLab
Escape or unescape HTML entities instantly right in your browser. Convert special characters into safe HTML entities, decode entity-heavy content back into readable text, and inspect your input with clean side-by-side analysis.
Perfect for developers, bloggers, CMS users, web editors, and anyone working with HTML snippets, code blocks, templates, emails, or content that needs safe rendering. It supports named entities, decimal entities, hexadecimal entities, quote controls, and repeated decoding.
Paste raw HTML-sensitive text or entity-heavy content to escape or decode it instantly.
HTML-safe output · named / numeric / hex entities · repeat decode · copy / download · no uploadsUse the left side for raw text or encoded entities and the right side for the converted result inside fixed scrollable editors.
1
1
Inspect what the input contains, including named entities, numeric entities, tags, angle brackets, quotes, and potential decode behavior.
Use Minimal safe HTML when you only need the essential characters escaped for safe display. Use Named entities for readable entity output. Use Numeric or Hex when you want more technical or machine-style entity formatting.
See what happened to the current result, including entity counts and output size.
Raw text with special HTML characters, already-escaped HTML snippets, named entities like &, numeric entities like &, hex entities like &, and mixed content copied from editors, CMS tools, HTML emails, or code blocks.
Character references represent reserved or hard-to-type characters in HTML source. Choose encode or decode, named or numeric style, quote and space handling, decode depth, and input cleanup from the exact destination context, then verify ampersands, angle brackets, quotes, non-breaking spaces, and Unicode characters.
Encoding less-than and ampersand is important in HTML text. Quote handling depends on the attribute delimiter. Data inserted into a URL, style, or script needs the rules of that language as well. Do not apply one generic entity pass to mixed markup and assume every parser boundary is secure.
Named references are readable for common symbols, while numeric references cover any allowed code point. Modern UTF-8 pages can contain most characters directly; references are most useful for reserved syntax, invisible spacing, or source conventions. Always include semicolons for predictable parsing.
A value such as an encoded ampersand may reveal another reference after one pass. Decode only the number of layers the data format expects. Multiple untrusted decoding steps can produce angle brackets, quotes, or script content and create an injection vulnerability in a later sink.
Inspect the transformed value in the exact parser context where it will be used.
Technical references: MDN character reference guide
Ampersand and less-than need special care because they begin references and tags. Greater-than is often escaped for clarity. Attribute quotes depend on the chosen delimiter.
Named references use memorable names for supported characters. Decimal and hexadecimal numeric references use the Unicode code point and can represent a broader set.
Usually not on a correctly declared UTF-8 page. Direct Unicode is readable and standard. Escape reserved syntax or use references where a specific source format requires them.
It creates a space that normally prevents a line break at that point. It is not a general indentation tool and can cause awkward wrapping when overused.
The first pass can reveal a second encoded sequence, and the next can turn it into markup or quotes. Decode only according to the defined data boundary.
No. Escaping must match the output context, and URL, CSS, JavaScript, and DOM sinks have different rules. Use safe APIs, sanitization, and a complete security design.