HTML Encoder / Decoder
Convert special characters to HTML entities and back. Encode ampersands, angle brackets, and quotes to their HTML entity equivalents, or decode entities back to plain text. Runs entirely in your browser.
How to Use
Common HTML Entities Reference
HTML encoding is essential for web security. When displaying user-supplied content in a page, encoding prevents browsers from interpreting the content as HTML markup. An unencoded string like <script>alert('xss')</script> entered by a user and displayed without encoding would execute as JavaScript. After encoding it becomes the harmless text <script>alert('xss')</script>. This is the primary defence against cross-site scripting (XSS) attacks.
Frequently Asked Questions
What are HTML entities?
HTML entities are special codes that represent characters with special meaning in HTML, such as < (less-than), > (greater-than), and & (ampersand). Writing these as entities tells the browser to display them as text rather than interpret them as HTML markup.
When should I encode HTML?
Always encode HTML when displaying user-supplied content in a web page. This prevents cross-site scripting (XSS) attacks where malicious users inject script tags or HTML into your page via form inputs or URL parameters. Most server-side frameworks do this automatically, but manual encoding is important when you are building raw HTML strings.
What characters are encoded?
The five critical characters are: & (becomes &), < (becomes <), > (becomes >), double quote (becomes "), and single quote (becomes '). These are the characters that can break HTML structure or enable injection attacks.
What is the difference between HTML encoding and URL encoding?
HTML encoding converts characters to HTML entity codes for safe use inside HTML content. URL encoding (percent-encoding) converts characters to %XX format for safe use in URL paths and query strings. They are different systems for different contexts. Use this tool for HTML and use the URL Encoder for URL components.
Is my data sent to a server?
No. All encoding and decoding runs in your browser using JavaScript. No text is ever uploaded, stored, or sent to any server.