HTML Entity Encoder/Decoder
Encode and decode HTML entities — prevent XSS and display special characters safely
Input
Output
About HTML Entity
HTML entities are escape sequences such as <, >, &, and " that let a page display characters that would otherwise be read as markup. Escaping user-provided text correctly is one of the main defenses against cross-site scripting.
This tool encodes special characters into HTML entities and decodes entities back to plain characters, in your browser. Use it to prepare text for inclusion in HTML, or to read content that arrives escaped. Escaping by hand is only appropriate for quick checks; in real applications rely on your framework's output escaping.
Common use cases
- Displaying a code snippet containing angle brackets inside an HTML page.
- Decoding double-escaped text from an API or database.
- Checking what a named entity such as © stands for.
- Escaping text for use inside HTML attributes.
Frequently asked questions
- Which characters must always be escaped?
- At minimum &, <, and >, plus quotes when the text is placed inside an attribute value.
- Is HTML escaping enough to prevent XSS?
- It helps for text placed in HTML content, but the correct escaping depends on context (attributes, URLs, scripts). Use your framework's built-in escaping.
- Why do I see &amp; in my text?
- The text has been escaped twice. Decode it once for each layer of escaping.