HTML Entity Encoder / Decoder
Show code samples on a web page, put text into HTML attributes safely, or read text full of & and ' entities.
Runs entirely in your browser. Your input and files are not uploaded to any server.
How to use
- Paste text or HTML.
- Choose Encode or Decode.
- For encoding, optionally convert every non-ASCII character to a numeric entity.
- Copy the result.
Examples
<div class="x"> → <div class="x">
Tom & Jerry's → Tom & Jerry’s
When to encode HTML entities
Characters such as <, > and & have a special meaning in HTML. If you paste a code sample into a page without encoding them, the browser may treat the sample as real markup and hide or break it. Encoding turns them into entities such as < and & so the text appears exactly as you typed it.
Decoding goes the other way: use it to read text copied from page source or from an API that shows &amp; or ' instead of the real characters. Encoding is only one layer of protection, so see the questions below for the contexts where it is not enough.
Privacy
Your files and text stay in your browser while you use this tool, and ads or anonymous visit statistics do not receive them. Only your favorites and recent tools are saved on your device. Privacy policy
Want proof? Check it with your browser’s Network tab: How to check that a tool does not upload your files
Frequently asked questions
Is escaping enough to prevent XSS?
Escaping text before inserting it into HTML element content or quoted attributes prevents it from being interpreted as markup. It is not enough for JavaScript, CSS or URL contexts, which need their own encoding.
Does decoding run the HTML?
No. Decoding uses an inert parser and returns plain text.