HTML Encoder and Decoder
Escape HTML special characters so markup displays as text instead of rendering, or decode entities back into plain characters.
How to use the HTML Encoder and Decoder
- Paste your HTML or entity-encoded text.
- Choose encode or decode.
- Copy the result.
About the HTML Encoder and Decoder
Escaping user input before it is inserted into a page is the basic defence against cross-site scripting: converting angle brackets and ampersands into entities means a submitted <script> tag displays as text rather than executing. It is also what you need when writing a tutorial that shows code examples on a page. Decoding goes the other way, turning entity-laden output back into something readable.
Frequently asked questions
Which characters need HTML encoding?
Primarily < > & " and ', because they have structural meaning in HTML and attributes.
Does encoding prevent XSS?
Escaping output correctly for its context is a key defence, but it is not a complete solution on its own — validate input and set a content security policy too.
Why do I see &amp; in my page?
Double encoding — the text was escaped twice. Decode it once here to fix it.
Related free tools
- HTML Viewer & Tester — Paste any HTML/CSS/JS and see the live output instantly.
- Meta Tag Generator — SEO title, description, Open Graph & Twitter tags — copy-ready.
- What Is My IP — Your public IP address, browser & device details.
- JSON Formatter — Beautify, minify and validate JSON instantly.
- Base64 Encode / Decode — Text or images ⇄ Base64 — handles huge data without freezing.
- URL Encode / Decode — Encode text for URLs or decode query strings.