Does this run entirely in my browser?

Yes. Both escape and unescape use the browser's built-in DOM and string APIs. No content is sent to any server — paste freely, including content with secrets or PII.

Which HTML entities does it cover?

By default it escapes the five characters that matter for XSS: & (ampersand), (greater-than), " (double quote), and ' (apostrophe). Unescape additionally decodes all named HTML entities plus numeric character references (© and ©).

Is escaping alone enough to prevent XSS?

For plain HTML body text contexts, yes — escaping the five critical characters prevents tag injection. But other contexts (inline JavaScript, CSS, URLs, HTML attributes with unquoted values) require their own escaping or different defenses. Treat HTML escape as one layer in a defense-in-depth strategy.

What's the difference between escape and sanitize?

Escape preserves all input — it just makes potentially dangerous characters safe by converting them to entities. Sanitize removes content — it strips or rewrites whole tags and attributes that don't pass a whitelist. Use escape when you want to display plain text; sanitize when you want to allow some safe HTML.

Can I escape HTML for attribute values specifically?

Yes. The default escape mode covers double quotes (for double-quoted attributes) and single quotes (for single-quoted attributes). For maximum safety in attribute contexts, also avoid unquoted attribute values entirely — that's where the trickiest XSS vectors live.

Does it handle international characters?

Yes. Unicode characters pass through unchanged in escape mode (modern browsers handle UTF-8 natively). On the unescape side, numeric entities for any Unicode codepoint are decoded correctly, including emoji and characters from any script.

Why does my escaped string still get rendered as HTML?

You're probably using innerHTML or dangerouslySetInnerHTML somewhere downstream — these bypass escaping. Switch to textContent (DOM) or pass the value as a child node in React/JSX, which handles escaping automatically.

轉換工具屬於轉換工具 →

HTML 跳脫字元

將文字轉換為 HTML 實體，或將實體還原為文字。

資料留在您的裝置無需上傳至伺服器可離線使用

跳脫情境

實體格式

拖入 .html / .txt 檔（或點擊上傳）最大 5MB —— 完全在瀏覽器內處理

輸入

跳脫結果

&lt;div class=&quot;tool&quot;&gt;&amp; &quot;fast&quot;&lt;/div&gt;

還原結果

<div class="tool">& "fast"</div>

為什麼用這個工具

安全地轉換 HTML 特殊字元，防止 HTML 注入問題。

適合準備 HTML 標記內容。

兩個方向即時轉換。

怎麼使用

01貼上文字或 HTML 實體。

02複製已跳脫或已還原的輸出。

複製前快速檢查

先確認輸入格式符合您的預期。

在把結果用於文件、連結、設定或訊息前快速掃一眼。

只複製您真正需要的輸出。

常見問題

是否在本地執行？

是。轉換完全在瀏覽器中完成。

涵蓋哪些 HTML 實體？

標準集合：& (and 符號)、< (小於)、> (大於)、" (雙引號) 及 ' (單引號)。

可防止 XSS 攻擊嗎？

可以。跳脫使用者輸入可防止在瀏覽器中渲染時發生 HTML 注入。

HTML 跳脫字元

為什麼用這個工具

怎麼使用

複製前快速檢查

常見問題

相關工具

JSON Escape / Unescape

URL 編解碼

JSON 格式化工具

HTML 跳脫字元

JSON Escape / Unescape→

URL 編解碼→

JSON 格式化工具→

JSON Escape / Unescape

URL 編解碼

JSON 格式化工具