What is escaped
A character reference starts with an ampersand and ends with a semicolon, and stands for one character [1]. Escape writes the five characters below as references. Turn on the option to also write every non-ASCII character as a decimal number, one reference per character, so an emoji is one reference.
& → & < → < > → > " → " ' → '
How unescape reads references
Unescape reads the 2,125 named references that end in a semicolon from the standard’s table [3](the page was last updated 12 November 2026), plus decimal (é) and hexadecimal (é) numbers. A number of 0, a surrogate, or above 10FFFF becomes U+FFFD, and 128 to 159 map through the standard’s Windows-1252 table[2]. Anything else is left as written. Unescape runs once: &lt; becomes <, not <.
Example
Input: <a href="x">Tom & Jerry's café 😀</a>
- Escape:
<a href="x">Tom & Jerry's café 😀</a> - Escape with non-ASCII as numbers:
<a href="x">Tom & Jerry's café 😀</a>(é is 233, the emoji 128512) - Unescape either one and you get the input back.
Questions
Does my text leave my device?
No. The page does the work in your browser and sends nothing anywhere. It makes no network request while you type or paste.
Which characters should I escape?
This tool escapes & < > " and '. Which characters need escaping depends on where the text goes, such as page text or a quoted attribute value. It does not sanitize HTML or judge whether text is safe to publish.
Why ' and not '?
' is a numeric reference, understood wherever character references are. Unescape also reads ', because it is in the standard’s table [3].
What happens to unknown names or a missing semicolon?
They are left exactly as written, and the tool lists unknown names. It reads only references that end in a semicolon.
Why did – become an en dash?
The HTML standard maps the numbers 128 to 159 through a Windows-1252 table, so – is “–”, not a control character [2].