HTML encoder / decoder
Display user input safely by converting < to < and & to &. Decode entities when reading stored HTML snippets back to plain text for search indexing. Runs locally for template and CMS debugging.
Input
Output
Hello world
How to encode or decode HTML
1. Choose encode (escape) or decode mode.
2. Paste HTML or plain text.
3. Copy escaped output for template or attribute.
4. Decode to read entity-heavy XML/HTML exports.
HTML entity examples
User comment safe display
Input <script>alert(1)</script> becomes harmless text when encoded for innerHTML-safe insertion via text node.
Apostrophe in attribute
O'Reilly in title attribute encodes quote as ' or ' depending on context.
Decode CMS export
Product description & copy; decodes to & for editing.
When to encode HTML
• When inserting untrusted text into HTML templates.
• When debugging double-encoding in email templates.
• When preparing markdown-generated HTML snippets.
When encoding is not enough
• When you need sanitize HTML with allowed tags — use DOMPurify style library.
• When content is JavaScript string — also escape quotes for JS context.
• When URL in href — use URL encoder separately.
Context matters
HTML escaping for attribute values may differ from text nodes — quotes matter in attributes. OWASP cheat sheet lists JS and CSS contexts too.
Double encoding bug
&amp; in DB means someone encoded twice — decode once, fix pipeline, encode once at output.
Email HTML
Clients vary on entity support — test encoded special chars in Outlook and Gmail.
Frequently asked questions
Named vs numeric entities?
& vs & — equivalent for common chars; emoji may need 😀 numeric form.
Encode whole HTML document?
Encoding whole doc shows literal tags — usually encode user data only.
XSS prevention?
Encoding text nodes helps; never concat raw user HTML. CSP headers add defense.
UTF-8 characters?
Often left as UTF-8 in modern HTML5; entities optional for non-ASCII.
Local?
Yes.
Markdown output?
Pair with markdownToHtml — encode happens at render layer in proper pipelines.