Escape text so it's safe to drop into HTML (< > & " '), or decode entities back to readable text. Runs in your browser.
To display user text or code as text inside an HTML page, the characters <, >, &, ", and ' must be escaped to entities — otherwise the browser treats them as markup (and unescaped user input is the classic XSS hole). Decoding does the reverse: turn < back into <. The optional encode non-ASCII turns accented letters, CJK, and emoji into numeric entities for legacy-charset safety, while leaving normal ASCII readable.
JSON string escape · URL encode · Base64 · All developer tools