HTML Encoder and Decoder
Escape HTML special characters so markup displays as text instead of rendering, or decode entities back into plain characters.
How to use the HTML Encoder and Decoder
- Paste your HTML or entity-encoded text.
- Choose encode or decode.
- Copy the result.
About the HTML Encoder and Decoder
Escaping user input before it is inserted into a page is the basic defence against cross-site scripting: converting angle brackets and ampersands into entities means a submitted <script> tag displays as text rather than executing. It is also what you need when writing a tutorial that shows code examples on a page. Decoding goes the other way, turning entity-laden output back into something readable.
Frequently asked questions
Which characters need HTML encoding?
Primarily < > & " and ', because they have structural meaning in HTML and attributes.
Does encoding prevent XSS?
Escaping output correctly for its context is a key defence, but it is not a complete solution on its own — validate input and set a content security policy too.
Why do I see &amp; in my page?
Double encoding — the text was escaped twice. Decode it once here to fix it.
Related free tools
- Base64 Encode / Decode — Text or images ⇄ Base64 — handles huge data without freezing.
- URL Encode / Decode — Encode text for URLs or decode query strings.
- Hash Generator — SHA-256 / SHA-1 / SHA-512 of any text.
- Regex Tester — Test regular expressions with live match highlighting.
- Unix Timestamp Converter — Timestamp ⇄ human-readable date.
- Markdown Preview — Live preview of headings, bold, lists, links & code.
Runs entirely in your browser — nothing you enter is uploaded. Last reviewed and updated .