HTML Encoder/Decoder
Encode or decode HTML entities. Fast, private, and easy to use.
Mode:
Entity Type:
Encode or decode HTML entities. Fast, private, and easy to use.
The HTML Encoder/Decoder escapes special characters into HTML entities and converts entities back into readable text. It is made for developers who need to show code samples on a page, sanitize user input, or fix text that was double-encoded somewhere along the way.
€ and €)Characters like < and > are not just text to a browser — they are the syntax of HTML itself. If you write a tutorial that shows the snippet <div class="box"> without escaping it, the browser will try to render that div instead of displaying the code, breaking your page layout. Encoding turns it into <div>, which the browser shows as literal text.
The same mechanism is a frontline defense against cross-site scripting (XSS). If an application displays user-submitted text without escaping it, an attacker can submit a script tag and have it executed in other visitors’ browsers. Escaping <, >, quotes, and & before rendering user content neutralizes that attack. A common mistake to watch for is encoding twice: < becomes &lt;, which displays as the literal text ”<” instead of ”<”.
HTML encoding replaces special characters with entity references to prevent browsers from interpreting them as HTML.
To safely display HTML code in web pages and prevent XSS attacks.
Safe mode escapes only the five dangerous characters (&, <, >, double quote, single quote). Full mode additionally converts every non-ASCII character into a numeric character reference, which is useful for pages without UTF-8 charset declarations.