HTML Entity Encoder / Decoder
Convert special characters to HTML entities and decode entities back to characters
Input Text
Result
Usage Examples
XSS Prevention
Encode HTML tags and special characters to prevent Cross-Site Scripting (XSS) attacks when displaying user input.
HTML Source Display
Encode HTML code so it can be safely displayed as text within web pages without being rendered.
Special Characters
Decode HTML entities like &, <, > back to their original characters for text processing.
Features
XSS Protection
Encode user input to prevent cross-site scripting attacks in web applications
Two-Way Conversion
Encode characters to entities and decode entities back to characters seamlessly
Named & Numeric Modes
Choose between human-readable named entities or universal numeric entities
Privacy First
All processing runs locally in your browser, no data sent to servers
How to Use
Choose Entity Mode
Select Named mode for readable entities like & or Numeric mode for & format.
Enter Text
Type or paste the HTML code or text you want to encode, or paste encoded entities to decode.
Encode or Decode
Click Encode to convert to entities, or Decode to convert entities back to characters. Copy the result.
Frequently Asked Questions
What Is an HTML Entity Encoder?
If you have ever pasted user input into a web page and watched the layout break, you already know why HTML entities matter. Characters like <, >, &, and " have special meaning in HTML, so they need to be escaped before they hit the DOM. This tool handles that conversion instantly -- paste your text, pick named or numeric mode, and grab the result.
Encoding vs. Decoding
Encoding turns raw characters into safe entity references (<, &, etc.) so browsers render them as text instead of markup. Decoding does the reverse -- handy when you pull entity-encoded strings from a database or API and need the original characters back.
Common Use Cases
The biggest one is XSS prevention: encoding user input before rendering it closes a major attack vector. Developers also use it to display code examples inside blog posts or documentation without the browser trying to execute the markup.
Quick Tips
Use named entities for the five most common characters (&, <, >, ", ') since they are easy to spot in code reviews. Switch to numeric mode when you are dealing with extended Unicode characters that do not have named equivalents.
Privacy Note
All encoding and decoding happens right in your browser. Nothing is uploaded, nothing is logged. Close the tab and it is gone.