# Escape an HTML string (/docs/guides/util/escape-html)

<!-- agent-signals: reading_time_min: 1 · est_tokens: 122 · updated: 2026-07-28 -->
Related: [Upgrade Bun to the latest version](/docs/guides/util/upgrade.md), [Detect when code is executed with Bun](/docs/guides/util/detect-bun.md), [Get the current Bun version](/docs/guides/util/version.md), [Hash a password](/docs/guides/util/hash-a-password.md), [Generate a UUID](/docs/guides/util/javascript-uuid.md), [Encode and decode base64 data](/docs/guides/util/base64.md)

`Bun.escapeHTML()` escapes HTML characters in a string. It makes the following replacements.

* `"` becomes `"&quot;"`
* `&` becomes `"&amp;"`
* `'` becomes `"&#x27;"`
* `<` becomes `"&lt;"`
* `>` becomes `"&gt;"`

This function is optimized for large input. Non-string values are converted to a string before escaping.

```ts
Bun.escapeHTML("<script>alert('Hello World!')</script>");
// &lt;script&gt;alert(&#x27;Hello World!&#x27;)&lt;/script&gt;
```

***

See [Utils](/runtime/utils).