Code and data

String Escape Tool

Escape and unescape strings for HTML, JavaScript and URLs.

  • Free
  • Runs in your browser: nothing is sent
  • No limit: it runs on your device
  • No sign-up

Try<script>alert("hello")</scr…Tom & Jerrya "quote" and 'single'

About String Escape Tool

Escape a string so it can be safely embedded in HTML, in a JavaScript literal, or in a URL — and reverse the process when you need the original text back.

  • HTML entity escaping for safe display of user content
  • JavaScript string escaping including quotes and newlines
  • URL escaping for query values and path segments
Questions · 2

Why does escaping matter for security?

Unescaped user input is how cross-site scripting happens. Escaping ensures text is displayed as text rather than executed as markup or code.

Which mode should I use?

Match the destination: HTML escaping for page content, JavaScript escaping for code literals, URL escaping for anything going into a link.

Use it from code · API

String Escape Tool runs in your browser, so there is no server call for it. API docs covers the tools you can call from code.

People also use