HTML Entity Encoder
/html-entity-encoderEncode special characters as HTML entities or decode entities back to plain text. Essential for XSS-safe output.
User-generated text pasted into HTML can break layouts or open the door to injection attacks. This encoder converts special characters into their HTML entities, making output XSS-safe. The reverse direction decodes entities back to plain text for reading or editing. Both directions run entirely in your browser.
- 01Upload
- 02Configure
- 03Run
- 04Download
Loading tool...
FAQ
Frequently asked questions
Everything you need to know about html entity encoder.
Which characters are encoded?
The five essential ones: ampersand, less-than, greater-than, double quote, and single quote. All other characters pass through unchanged.
Why encode HTML entities?
Encoding user-supplied text prevents HTML injection and XSS attacks, and it lets you display code snippets literally in a web page.
Can it decode numeric entities?
Decoding covers the named entities amp, lt, gt, quot, and the apostrophe forms 39 and x27. Other named or numeric entities are left untouched.
Is my text uploaded?
No. Conversion runs locally with simple string replacement, so nothing leaves your browser and the encoded text is never stored.
Should I use this for JSON strings?
Only in HTML contexts. Inside JSON, different escaping rules apply, so prefer JSON escaping for data interchange.
What about double encoding?
Decoding already-encoded text once is correct; decoding a second time turns entities into literal entity text in your output.
Related tools
same category · same privacy