What escaping does
HTML gives a handful of characters a job. Angle brackets open and close tags, the ampersand starts an entity, and quotes delimit attribute values. When you want those characters to appear on a page as themselves, as content rather than markup, they have to be written as entities: < for the less-than sign, > for greater-than, & for the ampersand, " for the double quote and ' for the single quote. Escaping converts your text into that safe form; unescaping converts it back.
Both directions run entirely in your browser, so nothing you paste here is uploaded anywhere.
Worked examples
Unescaping handles the full range of entities, not just the five above: named ones like £ and , decimal references like £ and hexadecimal ones like £ all come back as characters. It works by writing the text into a detached textarea element and reading the value back, which decodes entities without ever rendering or executing anything.
Escaping and XSS
The reason escaping matters beyond tidy display is cross-site scripting. If a site takes user input, a comment, a username, a search term, and places it into a page without escaping, an attacker can submit markup instead of text: a script tag, or an attribute that runs code when the element loads. Escaped, that same payload displays harmlessly as visible text, because the browser sees <script> rather than a real tag. This is why every serious template engine escapes output by default, and why quotes are on the list: inside an attribute value, an unescaped quote can end the attribute early and smuggle in new ones.
Two honest caveats. First, escaping is the right defence for text placed into HTML content or attributes, but not for every context; text going into a URL needs percent encoding (see the URL encoder) and text going into JavaScript needs its own rules. Second, escaping on the way in is usually the wrong place to do it: store the raw text and escape at the moment of output, otherwise you end up double-escaping and showing users &amp; soup.
When you will reach for this
The everyday cases: showing code snippets on a web page or in a blog post so the tags display instead of rendering; preparing sample HTML for documentation; pasting markup into a CMS field that renders HTML; and the reverse trip, cleaning up text copied from a page source or an RSS feed that arrived full of & and ' noise. If a page ever shows you literal entity codes where punctuation should be, that text was escaped one time too many, and one pass through unescape here will restore it. The same trick rescues text exported from old databases and email systems, which often arrive with every apostrophe stored as an entity code.
Frequently asked questions
Which characters does escaping convert?
The five with special meaning in HTML: the ampersand becomes &, the less-than sign becomes <, the greater-than sign becomes >, the double quote becomes " and the single quote becomes '. Everything else passes through unchanged.
Why do the quotes need escaping too?
Angle brackets and ampersands matter anywhere in HTML, but quotes matter inside attribute values. If user text goes into something like a title or value attribute, an unescaped quote can end the attribute early and let the rest of the text act as markup. Escaping all five characters is safe in every position.
Does escaping user input prevent XSS?
It is the core defence for text placed into HTML, yes. Escaping means a pasted script tag displays as text instead of running. But context matters: text going into a URL, a style block or a script block needs different handling, and frameworks like React escape output for you by default.
Will unescape run scripts from the text I paste?
No. Decoding happens inside a detached textarea element that is never added to the page, and a textarea treats its content as plain text, so nothing is executed or rendered. It simply converts entities like & and £ back into characters.
Is my text uploaded anywhere?
No. Both directions run entirely in your browser with JavaScript, so snippets, templates and user data never leave your device.