HTML entities encoder/decoder

Escape special characters as HTML entities or decode entities back to text. Helps prevent broken markup and XSS.

Runs in your browser ยท nothing is sentEncoding

About this tool

Encode &, <, >, quotes and apostrophes as entities, or decode named and numeric entities back to normal text.

๐Ÿ”’ Your input stays in your browser and is never sent anywhere.

Frequently asked questions

Does escaping prevent XSS?

Escaping output in the right context is a key defense, but it is not the only one. Use a framework that escapes by default.

What to do next

Also useful

Found a problem or have a suggestion? Tell us