HTML Entity Encode / Decode
Encode or decode HTML entities and special characters.
Input
Output
About the HTML Entity Encode / Decode
Convert special characters to HTML entities and back. Escaping is what prevents user-supplied text from being parsed as markup — turning < into < is the difference between displaying a code sample and executing a cross-site scripting payload.
How to use it
- 1 Choose Encode to convert characters into entities, or Decode to reverse it.
- 2 Paste your text into the input area.
- 3 The output updates as you type.
- 4 Copy the escaped text into your HTML.
What it does
- Encode reserved characters to named entities
- Decode both named (&) and numeric (&) forms
- Optional encoding of all non-ASCII characters
- Round-trips safely without double-escaping
Frequently asked questions
Is my text uploaded?
No. Every calculation happens locally in your browser using JavaScript. Nothing you paste is uploaded, logged, or stored on a server, which makes the tool safe to use with production data, credentials, and customer records.
Which characters must be escaped in HTML?
In text content, & and < are mandatory. Inside a quoted attribute value you must also escape the quote character in use. Escaping > and both quote styles as well is the safer habit, since it removes any dependence on getting the context right.
Does escaping HTML prevent XSS?
It is the core defence, but only when applied in the right context. Escaping for HTML text does not make a string safe inside a <script> block, inside a URL attribute such as href, or inside a CSS rule — each context needs its own encoding. Use your framework's contextual escaping rather than escaping by hand.
What is the difference between & and &?
Nothing to the browser — both produce an ampersand. & is the named form and is more readable; & is the decimal numeric form, and & is hexadecimal. Numeric forms work for any character, whereas named entities exist only for a defined set.