HTML Entity Encoder & Decoder

What this tool does

Certain characters have special meaning in HTML. If you display user content without escaping them, the browser may interpret it as markup — breaking your page or enabling cross-site scripting (XSS) attacks. HTML entity encoding replaces those characters with safe codes so they appear as plain text.

The key characters

• < becomes <
• > becomes >
• & becomes &
• " becomes "
• ' becomes '

Example

The string <b>Hi & bye</b> encodes to <b>Hi & bye</b>, which a browser renders literally instead of making bold text.

Limitations

• Encoding for display is only one layer of defense. Always combine output encoding with proper input validation and a Content Security Policy.
• This tool escapes the five core characters, which is the standard recommendation for HTML body and attribute contexts.

How to fix common problems

• Double-encoded output (<): your input was already encoded. Decode it once first.
• Entity not decoding: make sure it ends with a semicolon, e.g. ©.

Related tools

• URL Encoder & Decoder
• Base64 Encoder & Decoder
• Hex Encoder & Decoder