HTML Entity Encoder / Decoder
Safely encode HTML special characters, or decode entity-encoded text back to plain text. All processing happens in your browser; your input is never sent to the server.
When you want a browser to display <div> as text instead of creating a division, the angle brackets have to become < and >. That is HTML entity encoding, and it is also the front line against cross-site scripting: user input rendered without encoding is how script injection happens. This tool converts in both directions.
How to use it
- Paste your text or markup into the input.
- Press Encode to turn &, <, >, " and ' into their entity forms — the five characters that matter for safe output.
- Press Decode to go the other way, turning &nbsp; and friends back into real characters.
- Copy the result into your template, documentation or code sample.
Frequently asked questions
- Which characters actually need encoding?
- Five: & < > " and '. Everything else is safe in HTML body text. Encoding more than these makes markup unreadable without adding safety.
- Is decoding here dangerous?
- No. The decoder reads the value out of a textarea element, so the content is never parsed as live HTML and no script can run.
- Does this protect my site from XSS?
- It is the right transformation, but protection comes from applying it at output time in your code, on every untrusted value. A one-off conversion in a browser tool does not secure an application.
- Why is my & turning into &amp;?
- You encoded text that was already encoded. Encode exactly once, at the point of output.