HTML Encoder/Decoder — Escape and Unescape HTML Entities Instantly
Pasting user-submitted text straight into HTML and leaving <, >, or & unescaped is the #1 cause of XSS vulnerabilities. This HTML encoder / decoder converts those characters to safe entities instantly: < becomes <, > becomes >, & becomes &. The reverse — paste < and get < back — is just as fast. Web developers use it before inserting user content into templates, CMS editors use it to decode database exports, and email developers use it to fix entity rendering in Outlook. No signup needed.
What Is HTML Encode / Decode?
An HTML encoder/decoder converts special characters to their HTML entity equivalents — and back again. Characters that have special meaning in HTML markup (< > & " ') must be escaped to appear as literal text content rather than being interpreted as HTML tags or attributes. The encoder converts these characters to their named or numeric entity references: & becomes &, < becomes <, > becomes >, " becomes ".
HTML encoding is essential for security and correct rendering. Displaying user-generated content in a web page without encoding it is the primary cause of Cross-Site Scripting (XSS) vulnerabilities — a malicious user could inject <script> tags that execute in other users' browsers. Encoding also ensures that text containing < or & displays correctly rather than breaking the page's HTML structure. This tool lets you encode text for safe HTML inclusion or decode HTML-encoded strings back to their human-readable form.
<h1>Hello & "World"</h1>→<h1>Hello & "World"</h1>Before & After: HTML Encode / Decode Examples
Real input → output pairs showing exactly what this tool does to your text.
| Input | HTML Encode / Decode Output |
|---|---|
<script>alert("XSS")</script> | <script>alert("XSS")</script> |
Tom & Jerry | Tom & Jerry |
Price: "£9.99" | Price: "£9.99" |
<p>Hello</p> (decode) | <p>Hello</p> |
5 < 10 and 10 > 5 | 5 < 10 and 10 > 5 |
Key Features
Converts the 5 characters that break HTML structure and enable XSS: & → &, < → <, > → >, " → ", ' → '. OWASP XSS Prevention Cheat Sheet lists HTML output encoding as the primary defence against reflected and stored XSS attacks.
Paste &lt;p&gt;Hello&lt;/p&gt; and get <p>Hello</p> back. Useful for reading CMS exports, database dumps, and RSS feed content that has been HTML-encoded.
Handles all HTML5 named character references (&, <, >, ", ', ) plus numeric decimal (&) and hexadecimal (&) references — the formats used in email templates, XML feeds, and legacy HTML.
Encoding happens entirely in your browser. User-submitted content, XSS payloads, and sensitive HTML strings never leave your device.
When to Use HTML Encode / Decode
Use when displaying raw HTML or code inside a web page, or storing user-submitted HTML safely.
Always HTML-encode user input before inserting it into the DOM to prevent XSS attacks.
Who Should Use This Tool?
Encode user-submitted content before inserting into HTML to prevent XSS vulnerabilities and ensure special characters render correctly.
Encode special characters in HTML email templates to prevent rendering issues across email clients with strict HTML parsers.
Decode HTML entities in CMS export files and database dumps to read actual content values during migrations and audits.
Industry Standard
HTML entity encoding is defined in the HTML5 specification (WHATWG Living Standard). The core named entities (& < > " ') are defined in RFC 1866 (1995) and have been part of every HTML version since. OWASP (Open Web Application Security Project) lists "HTML output encoding" as the primary defence against Reflected XSS in its XSS Prevention Cheat Sheet. The HTML5 parser recognises over 2,000 named character references; this tool covers the security-critical subset.
Key Use Cases
- →Encode user-submitted text before inserting into HTML page content to prevent XSS injection attacks.
- →Decode HTML entity-encoded content from CMS database exports to readable text for content migration.
- →Encode code samples containing < > and & for display in HTML
blocks without breaking markup. - →Encode email template content with special characters for reliable rendering across Outlook, Gmail, and Apple Mail.
- →Decode HTML-encoded XML or RSS feed content to read the actual article text for content parsing.
HTML Encode / Decode vs Other Formats
How this tool compares to related approaches and methods
| Method / Format | Best For |
|---|---|
| THISThis tool | Quick encode/decode of HTML entities, XSS payload neutralization, and CMS export cleanup |
| Template engine auto-escape (Django, Jinja2) | Web application output encoding — automatic, context-aware, applied to all template variables |
| JavaScript DOMPurify library | Security-critical HTML sanitization where rich HTML must be preserved but XSS removed |
| PHP htmlspecialchars() | PHP server-side HTML output encoding — fastest for plain text in HTML context |
HTML Encode / Decode Rules: How It Works
- →& → & — always encode first; & is the entity prefix character itself.
- →< → < — prevents text from being interpreted as an opening HTML tag.
- →> → > — prevents text from being interpreted as a closing HTML tag.
- →" → " — required inside double-quoted attribute values.
- →' → ' or ' — required inside single-quoted attribute values.
- →Non-ASCII characters (é, ñ, emoji) — optional but recommended for maximum email client compatibility.
- ×Double-encoding — encoding already-encoded content produces & instead of &. Check source before encoding.
- ×Don't use HTML encoding for URLs — use percent-encoding (%26) in URL contexts, HTML entities (&) in HTML attribute values.
- × is NOT a regular space — it's a non-breaking space that prevents line breaks. Use CSS for spacing, only where break-prevention is required.
- ×HTML encoding alone doesn't prevent all XSS — context matters. In