HTML entities encoder/decoder
Escape special characters as HTML entities or decode entities back to text. Helps prevent broken markup and XSS.
Runs in your browser ยท nothing is sentEncoding
About this tool
Encode &, <, >, quotes and apostrophes as entities, or decode named and numeric entities back to normal text.
๐ Your input stays in your browser and is never sent anywhere.
Frequently asked questions
Does escaping prevent XSS?
Escaping output in the right context is a key defense, but it is not the only one. Use a framework that escapes by default.
What to do next
Found a problem or have a suggestion? Tell us