HTML Entity Encoder & Decoder
Escapes the characters that carry meaning in HTML — & < > " and ' — into their entity forms, and decodes entities back into plain text. This is the transformation that turns a script tag into inert text rather than executable markup.
Escaping untrusted text before it reaches the DOM is the baseline defence against cross-site scripting, so this is a useful tool for checking what a value will look like once escaped.
How to use it
- Paste text containing HTML special characters to see the escaped form.
- Press Swap to decode entities back into characters.
- Named, decimal and hexadecimal entities are all understood when decoding.
Why the ampersand is handled first
Escaping naively — replacing & with & and then < with < — double-escapes, because the ampersands introduced by later replacements get escaped again. The result is &lt; where you wanted <.
This encoder replaces all five characters in a single pass, so < encodes to &lt; exactly once and decodes back to < rather than to <.
Decoding coverage
Decimal entities such as A and hexadecimal entities such as 😊 are resolved to their characters, including those outside the basic plane. A useful set of named entities is supported — including copy, reg, trade, nbsp, hellip, mdash and the common symbols — and anything unrecognised is left exactly as written rather than being mangled.
Frequently asked questions
Does escaping HTML make my page safe from XSS?
- It is necessary but not sufficient. Escaping is correct for text inserted into element content, but attribute values, URLs, inline JavaScript and CSS each need their own escaping rules. Use your framework's contextual escaping where you can.
Why is my < encoded to &lt; instead of staying the same?
- Because the input contains a literal ampersand, and encoding it is correct: displaying the text '<' on a page requires the source to say '&lt;'. Decode instead if you wanted the character.
What happens to an entity you do not recognise?
- It is returned untouched, so no data is lost and you can see exactly which entity was not understood.