What the HTML encoder does
To show a < on a web page rather than start a tag, it has to be written as <. This tool converts text to HTML entities (encode) and entities back to text (decode). It is how you display code samples on a page, put user-supplied text into HTML safely, and read what a garbled block of ' and " actually says. It runs in your browser.
The five characters that must be escaped
| Character | Entity | Why |
|---|---|---|
| < | < | Starts a tag |
| > | > | Ends a tag (escape for symmetry and safety) |
| & | & | Starts an entity |
| " | " | Ends an attribute value in double quotes |
| ' | ' (or ') | Ends an attribute value in single quotes |
Text: if (a < b && c > "d") { alert('hi'); }
Encoded: if (a < b && c > "d") { alert('hi'); }Encoding these five in any text placed into HTML is what stops user input from being interpreted as markup — the basic defence against cross-site scripting (XSS).
Named, decimal and hex entities
- Named:
©©, non-breaking space,——,€€. HTML5 defines over 2,000 names. - Decimal:
©©,——. Works for any Unicode code point. - Hexadecimal:
©©,——.
Since pages are UTF-8 today, most characters can be typed directly and only the five structural ones need entities. Entities remain useful for invisible characters ( , ‍), for characters hard to type, and for source that must stay pure ASCII.
Common uses
- Displaying HTML or code examples on a page, in a blog post or in documentation.
- Escaping strings before inserting them into a template by hand.
- Decoding text scraped from a page or an API that returned entities instead of characters.
- Reading email subject lines or RSS titles that arrived double-encoded (
&#39;). - Writing
titleandaltattributes that contain quotes.
Encoding is context-specific
HTML entity encoding is correct for text between tags and inside attribute values. It is the wrong encoding for other contexts: a value going into a URL needs percent-encoding, one going into a JavaScript string needs JavaScript escaping, and one going into CSS needs CSS escaping. Use the URL & Base64 encoder for URLs. Modern frameworks (React, Vue, Django templates, Rails ERB) escape HTML automatically; this tool is for the cases where you are writing raw markup.