Developer / TOOLKIT
HTML Encoder / Decoder
Escape HTML entities safely - prevent broken pages and XSS in user input.
Free to use · No account needed
How to use
- Paste text or raw HTML into the input box.
- Click Encode to escape < > & " ' (and optionally all non-ASCII).
- Click Decode to convert entities back to plain characters, or Swap to move the result to the input.
When you need to display code snippets on a web page, insert HTML into a WYSIWYG editor, or safely pass markup through an API, HTML encoding converts special characters like < > & " into their escaped entities. This prevents broken layouts, XSS injection and rendering errors. Use this tool to encode or decode HTML, JSON and URL components before embedding them anywhere.
Use cases
1. Use case: Prevent XSS in user input Encode user-generated text before embedding it in a page so <script> tags are displayed as text, not executed.
2. Use case: Show code examples in articles Encode HTML samples before pasting them into a blog post so readers see the tags instead of the rendered page.
Practical tips
HTML escaping converts the characters that have meaning to a browser — angle brackets, ampersands, quotes — into entities so code displays as text instead of executing. Use it whenever embedding code samples in a page or displaying user-provided text safely. This is not URL encoding, which uses a different character set for a different layer; converting a query string needs the other tool. Numeric entities and named entities are both valid output forms. Like every tool on this site, the Html Encoder runs entirely in your browser: the data you enter never leaves your device, nothing is uploaded to a server, and the tool keeps working if your connection drops.
Common mistakes
Escaping fails when the layer is confused:
- Confusing HTML escaping with URL encoding — different character sets for different layers; query strings need the other tool.
- Escaping text that will be rendered as HTML, which double-escapes and shows raw entities like <p> on screen.
- Forgetting to escape user-provided content inserted into a page, which is the classic opening for cross-site scripting.
- Converting only the angle brackets and leaving quotes and ampersands, which still breaks attributes.
Frequently asked questions
Does the Html Encoder send my data anywhere?
No. It runs entirely in your browser — your input is processed on your device and never uploaded. Refresh the page and it still works offline.