How to use the HTML Encoder / Decoder
- 1
Pick “Encode” or “Decode”.
- 2
For encoding, choose whether to escape only the essential characters or all non-ASCII characters too.
- 3
Paste your text and copy the converted output.
Features & benefits
Essential escaping
Converts & < > " and ' — the five characters that can break HTML.
Full escaping
Optionally converts every non-ASCII character to numeric entities for legacy systems.
Decodes everything
Understands named (é), decimal (é) and hex (é) entities.
Safe decoding
Decoding uses an inert parser, so pasted scripts are never executed.
Why HTML escaping matters
Browsers interpret “<” as the start of a tag and “&” as the start of an entity. If you want to show these characters literally — for example in a coding tutorial — they must be written as < and &.
Escaping is also a key defence against cross-site scripting (XSS). Any text that comes from users should be escaped before it is inserted into HTML so that it is displayed as text rather than executed as code.
Frequently asked questions
Which characters must be escaped?
Inside HTML text, & and < are essential. Inside attribute values, quotes must also be escaped. This tool escapes all five to be safe.
Is this enough to prevent XSS?
Escaping text placed in HTML content is a crucial step, but secure applications also need context-aware escaping for URLs, JavaScript and CSS.
What are numeric entities?
They reference a character by its Unicode number, such as © for ©. They work for every character, even without a named entity.