HTML encoder / decoder
Display user input safely by converting < to < and & to &. Decode entities when reading stored HTML snippets back to plain text for search indexing. Runs locally for template and CMS debugging.
How to encode or decode HTML
1. Choose encode (escape) or decode mode.
2. Paste HTML or plain text.
3. Copy escaped output for template or attribute.
4. Decode to read entity-heavy XML/HTML exports.
HTML entity examples
User comment safe display
Input <script>alert(1)</script> becomes harmless text when encoded for innerHTML-safe insertion via text node.
Apostrophe in attribute
O'Reilly in title attribute encodes quote as ' or ' depending on context.
Decode CMS export
Product description & copy; decodes to & for editing.
When to encode HTML
• When inserting untrusted text into HTML templates.
• When debugging double-encoding in email templates.
• When preparing markdown-generated HTML snippets.
Context matters
HTML escaping for attribute values may differ from text nodes — quotes matter in attributes. OWASP cheat sheet lists JS and CSS contexts too.
Frequently asked questions
Named vs numeric entities?
& vs & — equivalent for common chars; emoji may need 😀 numeric form.
Encode whole HTML document?
Encoding whole doc shows literal tags — usually encode user data only.
XSS prevention?
Encoding text nodes helps; never concat raw user HTML. CSP headers add defense.
UTF-8 characters?
Often left as UTF-8 in modern HTML5; entities optional for non-ASCII.
Local?
Yes.