为什么用这个工具
01HTML 转义在浏览器本地运行，适合快速处理与复制结果。
HTML 转义适用于日常高频小任务，打开即用。
默认本地处理，便于快速检查与复制结果。
如何使用
02复制前快速检查
03先确认输入格式符合你的预期。
在把结果用于文档、链接、配置或消息前快速扫一眼。
只复制你真正需要的输出。
使用场景
Before injecting user input into an HTML page (comments, profile bios, post content), escape it so malicious script tags and attribute injections can't execute. This is the baseline defense against reflected and stored XSS.
Application logs and many JSON APIs return HTML-escaped strings (<p> instead of <p>). Decode them to read the underlying content during debugging.
When writing technical docs that include code examples or HTML snippets, escape the HTML so the rendered docs show the markup as text instead of interpreting it as actual markup.
Different CMSes escape content differently. Use this tool to normalize HTML-escaped strings between WordPress, Markdown, Notion, and custom CMS exports during migrations.
使用技巧
- 01Context determines what's safe
HTML body text needs <, >, & escaped. HTML attributes additionally need quote characters (" and ') escaped. JavaScript contexts and URLs require entirely different encoding. "Escape once for the right context" is the rule — don't double-escape.
- 02Five entities cover 99% of cases
Most HTML escape needs are met by just five entities: & (ampersand), < (less-than), > (greater-than), " (double quote), ' (apostrophe). Beyond these are hundreds of named entities (©, —, etc.) but they're optional in modern UTF-8 documents.
- 03Numeric entities are universal
Named entities like © only work in HTML. Numeric entities like © (decimal) or © (hex) work in HTML, XML, and any spec that supports character references. When in doubt, use numeric.
- 04Escape is not the same as sanitize
Escaping converts dangerous characters to safe entities — fine for plain-text contexts. Sanitization removes or rewrites whole tags (e.g., dropping <script> while keeping <p>). For rich-text user input where some HTML must be preserved, use a sanitizer like DOMPurify, not just escape.
常见问题
04这个工具会上传数据吗？
默认在浏览器本地处理。