ToolbitHTML Escape and Unescape
Convert angle brackets, ampersands, and quotes into HTML entities so markup renders as text instead of executing. Handy when writing documentation, email templates, or CMS content.
What the HTML Escape & Unescape does
- Escapes &, <, >, ", and ' to their named entities.
- Unescapes both named and numeric entity references.
- Round-trips code samples you want to display literally in a page.
- Useful when auditing output for XSS-safe rendering.
How to use it
- Paste the markup or text you want to convert.
- Choose escape or unescape.
- Copy the result into your template or document.
Why it runs locally
Toolbit has no backend. The HTML Escape & Unescape is implemented with standard browser APIs, so your input is processed in the tab and never uploaded, logged, or retained. That is what makes it safe to paste real data into — and it is also why the tool keeps working with the network disconnected, once you have installed Toolbit as an app.
Frequently asked questions
- Does escaping HTML here make my app XSS-safe?
- It shows what correctly escaped output looks like, but real protection comes from escaping in your template layer. Use this to inspect and verify, not as a runtime defence.
- Are numeric entities supported?
- Yes. Unescaping resolves named entities such as &amp; as well as numeric ones such as &#38;.
- Is my content uploaded?
- Local transformations process input in your browser. HTTP and WebSocket tools send user-initiated requests. Optional product analytics is off by default, excludes tool input and output, and stays off when your browser signals Do Not Track or Global Privacy Control.