FIRST CH TOOLS LOCAL PROCESSING — NOTHING IS UPLOADED 日本語

FIRST CH TOOLS / 19 HTML ESCAPE

HTML Entity Escape & Unescape

Paste text and < > & " ' are turned into HTML entities. Paste entities such as &amp; or &#39; and they are decoded back — same screen, either direction, updated as you type, with warnings for double escaping and unterminated references.

Type into either box — the other side follows

Plain text
Escaped
0
Input characters
0
Output characters
0
Replacements
—
Breakdown
Checks

    Escaping handles & first, so running it twice on plain text is harmless — if &amp; becomes &amp;amp;, the input was already escaped, and the Checks list says so. Decoding never silently drops an unknown entity name: anything it does not recognise is left untouched and listed for you.

    How to Use

    1. Paste your textDrop HTML or plain text into the left box and the escaped form appears on the right. Paste entity-laden text into the right box and the original characters come back on the left.
    2. Match the options to the targetEscaping quotes is mandatory if the result goes inside an attribute. If the text has to survive a pipeline with a doubtful charset, switch non-ASCII to numeric references.
    3. Copy the resultHit Copy. Double escaping, bare ampersands, missing semicolons and unknown entity names are all listed under Checks.

    About This Tool

    In HTML, < means “a tag starts here” and & means “a character reference starts here”. Write either one raw in an article or a code sample and the browser reads it as an instruction rather than as text. To show them as characters you have to write &lt; and &amp; instead — that substitution is what escaping means.

    Only & and < strictly have to be escaped in element text; > is optional (this tool converts it anyway, because the pair reads better). Inside an attribute value the quotes are mandatory. A raw " inside title="…" closes the attribute right there and everything after it is parsed as more attributes — the classic way an HTML injection gets in.

    Apostrophes come out as &#39; by default. &apos; exists in XML and HTML5 but not in HTML 4.01, so old parsers print it literally. Tick the option only when you are working with XHTML or XML and prefer the readable name.

    Numeric references (&#12354; / &#x3042;) are insurance for pipelines where the character encoding may not survive — legacy mail systems, ASCII-only config files, a CMS whose charset nobody can confirm. On a page that correctly declares charset=UTF-8 they only make the source harder to read, so leave them off.

    Unknown entity names are never guessed at. Browsers rescue some semicolon-less references such as &nbsp, but which ones they rescue is a historical accident and parsers disagree. This tool leaves them alone and tells you the semicolon is missing. Numeric references in the C1 range, like &#128;, are mapped to their Windows-1252 characters (€ here) exactly as the HTML specification requires.

    A no-break space (U+00A0) looks like an ordinary space but is a different character. It hitches a ride on text copied out of Word or a web page and then becomes the reason a string comparison mysteriously fails. This tool always writes it out as &nbsp; and tells you it is there.

    Whatever you paste stays in your browser — the conversion and the checks all run locally. Directly callable via URL parameters: /en/html-escape/?text=<b>a&b</b> / /en/html-escape/?html=%26amp%3Bnbsp%3B

    From AI Agents

    The same escaping and decoding logic is available as the html_escape tool on the MCP (Model Context Protocol) server @first-ch/tools-mcp, so an AI agent can call it directly without driving a browser. See How to use from AI agents for setup.

    Install

    claude mcp add firstch-tools -- npx -y @first-ch/tools-mcp

    Examples

    # Escape HTML special characters
html_escape(text="<a href='/x'>a & b</a>")

# Decode entities back to characters
html_escape(mode="unescape", text="&lt;p&gt;5 &amp;lt; 10&lt;/p&gt;")

# Escape non-ASCII too, for charset-fragile pipelines
html_escape(text="café & crème", nonAscii="hex")

# Read a file, escape it, write the result out
html_escape(path="/tmp/in.txt", outputPath="/tmp/out.html")

    Other Tools