ToolbitHTML Escape and Unescape
Convert angle brackets, ampersands, and quotes into HTML entities so markup renders as text instead of executing. Handy when writing documentation, email templates, or CMS content.
What the HTML Escape & Unescape does
- Escapes &, <, >, ", and ' to their named entities.
- Unescapes both named and numeric entity references.
- Round-trips code samples you want to display literally in a page.
- Useful when auditing output for XSS-safe rendering.
How to use it
- Paste the markup or text you want to convert.
- Choose escape or unescape.
- Copy the result into your template or document.
Why it runs locally
Toolbit has no backend. The HTML Escape & Unescape is implemented with standard browser APIs, so your input is processed in the tab and never uploaded, logged, or retained. That is what makes it safe to paste real data into — and it is also why the tool keeps working with the network disconnected, once you have installed Toolbit as an app.
Frequently asked questions
- Does escaping HTML here make my app XSS-safe?
- It shows what correctly escaped output looks like, but real protection comes from escaping in your template layer. Use this to inspect and verify, not as a runtime defence.
- Are numeric entities supported?
- Yes. Unescaping resolves named entities such as &amp; as well as numeric ones such as &#38;.
- Is my content uploaded?
- No. Every Toolbit tool runs entirely in your browser using standard Web APIs. Your input is never uploaded, logged, or sent to a third party — you can open the network tab and watch it stay quiet.