HTML Encoder/Decoder
Escape and unescape HTML entities.
What is the HTML Encoder/Decoder?
HTML encoding replaces characters that have structural meaning in markup — &, <, >, " and ' — with entity equivalents such as & and <. That makes the text display literally instead of being parsed as tags, which is the underlying defence against cross-site scripting.
Frequently asked questions
Does HTML encoding prevent XSS?
Correct contextual escaping is the core of it, yes. But the right escaping depends on where the value lands: inside an HTML body, an attribute, a URL or a script block each need different treatment. Encoding for the wrong context can still leave a hole.
Why is my output showing &amp; instead of &?
That is double encoding — the text was escaped twice, so the & in & got escaped again. Decode once to get back to &, and fix the pipeline so only the final render step escapes.
Related Encoders & Decoders
- Base64 Encode/DecodeConvert text and files to and from Base64.
- JWT DecoderInspect JWT headers, claims and expiry.
- URL Encoder/DecoderPercent-encode and decode URLs and query strings.
HTML Encoder/Decoder is one of 4 tools in Encoders & Decoders on Toolkit Hub, a free collection of browser-based utilities. It requires no account and no installation. Browse all tools.