HTML / Entity Encoder-Decoder
Encodes text to HTML entities (e.g. < → <) or decodes entities back. The conversion happens entirely in your browser; the text is not sent to a server.
Output
Enter text in the field on the left; the result appears instantly.
Frequently Asked Questions
What is the difference between HTML encoding and URL encoding?
HTML encoding converts characters that are meaningful in an HTML document (< > & " ') into entities so the browser does not treat the text as markup. URL encoding (percent-encoding) converts characters that are unsafe in a URL into %XX form. They serve different contexts and are not interchangeable.
Which characters must always be encoded in HTML?
At minimum five characters: & (&), < (<), > (>), " (") and ' ('). The & must be encoded first, otherwise the other entities break. Encoding the quote character is critical when attribute values are quoted.
Why is ' used instead of '?
The named entity ' is defined in HTML5 but did not exist in HTML4 and some older browsers. The numeric reference ' works in every version, so it is the safest, most portable choice for a single quote. This tool emits ' on encode.
How do I HTML-encode in .NET?
System.Net.WebUtility.HtmlEncode(string) works with no dependencies; in web projects System.Web.HttpUtility.HtmlEncode is also available. In Razor, @variable expressions automatically HTML-encode the output — printing raw HTML deliberately requires @Html.Raw.
Does this tool fully prevent XSS?
Not on its own. HTML encoding is the correct defence when printing data into an HTML body; but attribute, JavaScript, CSS and URL contexts need different escaping rules. The right approach is context-aware encoding + a Content Security Policy + input validation. This tool helps you see and verify the encoding.