Escape / Unescape

Escape or unescape HTML, URL, JavaScript, SQL and more โ€” instantly in your browser.

Ad
Input
Output
Ad

About Escaping & Unescaping

Escaping converts special characters into safe representations that can be embedded in a specific context without breaking the syntax. For example, < in HTML must be escaped as &lt; to prevent it being interpreted as a tag. URL encoding (percent-encoding) replaces characters like spaces and special symbols with %XX sequences. JavaScript string escaping adds backslashes before quotes and control characters. SQL escaping prevents injection by escaping single quotes.

Unescaping reverses this process, converting encoded sequences back to their original characters. This tool handles HTML entities (both named and numeric), URL/percent encoding, JavaScript strings, SQL string escaping, and Base64 encoding/decoding. All processing runs locally in your browser.


How to Use

  1. Choose Escape or Unescape mode.
  2. Select the encoding type: HTML, URL, JavaScript, SQL or Base64.
  3. Paste or type text in the left panel โ€” the result appears instantly on the right.
  4. Click โฟป Copy to copy the output, or โ‡„ Swap to move the output back to input.

Frequently Asked Questions

URL encoding (percent-encoding) is used in URLs and query strings โ€” spaces become %20 or +, and special characters like & become %26. HTML encoding is used inside HTML documents โ€” the characters <, >, &, and " are replaced with named entities like &lt; and &amp;. You need both when embedding user data in an HTML page that also contains URLs.

Basic SQL escaping (doubling single quotes) provides some protection but is not the recommended approach. Parameterised queries / prepared statements are the correct way to prevent SQL injection โ€” they separate the query structure from the data entirely, so user input can never be interpreted as SQL code, no matter what characters it contains. Use this tool for understanding or debugging, not as a production SQL sanitiser.

No. All encoding and decoding happens entirely in your browser. Nothing is sent to any server.

Ad