HTML / Entity Encoder-Decoder
Encodes text to HTML entities (e.g. < → <) or decodes entities back. The conversion happens entirely in your browser; the text is not sent to a server.
Last updated:
Output
Enter text in the field on the left; the result appears instantly.
When this encoder earns its keep
Publishing code samples
Showing a <script> tag as text in an article requires encoding it, or the browser treats the example as an instruction. Documentation and blog platforms are where entity encoding does its quietest, steadiest work.
Investigating a suspected XSS payload
Reported payloads arrive wrapped in layers: numeric references, double encoding, mixed contexts. Peeling them here, one decode at a time, reveals what element the payload was actually trying to construct.
Repairing a mangled content migration
Imports between systems routinely encode already-encoded text, leaving &eacute; where é belongs. Counting how many decodes restore the text tells you how many layers over-encoded during the migration.
Worked example: one line of XSS, defused by five characters
The classic probe <img src=x onerror=alert(1)> makes the whole mechanism visible in a single line.
- As raw markup, the browser fetches src=x, the fetch fails, and onerror runs the script: markup became behaviour.
- Encode it here: <img src=x onerror=alert(1)>.
- Rendered, the encoded form is inert text; the browser never sees a tag, only characters that look like one.
- The entire difference lives in the five critical characters: & < > " and '.
- Order matters when encoding: & must be encoded first, otherwise < becomes the double-encoded &lt;.
Entity encoding is the correct defence exactly where data lands in HTML body or quoted-attribute contexts. JavaScript strings, CSS values and URLs each have their own escaping rules, and applying HTML encoding there gives a false sense of safety. Name the context first; the encoding follows from it.
Four mistakes worth avoiding
Sanitising on input and trusting it forever
Data cleaned at registration time gets rendered years later in contexts nobody anticipated: emails, PDFs, admin panels, APIs. Encode at output, per context, every time; input validation is a data-quality measure, not an XSS defence.
Leaving attributes unquoted
In value=@x with no quotes, a space starts a new attribute and no amount of entity encoding prevents it, because spaces are legal unencoded. Quote every attribute and encode the quote character; the two measures only work together.
Assuming decode is harmless to repeat
Decoding &lt; once yields <; decoding again yields a live <. Run twice over stored double-encoded data, a "cleanup" script can create markup that was never there. Decode exactly once, then fix whatever encoded twice.
Reaching for innerHTML out of habit
If the goal is showing text, textContent renders any string safely with zero encoding decisions. innerHTML plus hand-encoding is the fragile version of the same feature; reserve it for cases that genuinely need markup.
Tools commonly used alongside this one
- Base64 Encoder-Decoder Encode text to Base64 or decode it back. Standard and URL-safe (base64url) variants; UTF-8 aware, in the browser.
- HTML Viewer Paste HTML source and preview it live instantly. In a sandboxed, isolated frame; scripts are disabled for safety.
- JWT Decoder Decode the header and payload of a JSON Web Token, inspect the standard claims and expiry. The token never leaves your browser.
- Kubernetes Resource Budget Calculator Estimate how many nodes you need, your packing efficiency, and the projected monthly cost from pod requests and node size.
- UUID Generator Generate cryptographically secure UUID v4 and time-ordered v7. Bulk generation and format options.
Frequently Asked Questions
What is the difference between HTML encoding and URL encoding?
HTML encoding converts characters that are meaningful in an HTML document (< > & " ') into entities so the browser does not treat the text as markup. URL encoding (percent-encoding) converts characters that are unsafe in a URL into %XX form. They serve different contexts and are not interchangeable.
Which characters must always be encoded in HTML?
At minimum five characters: & (&), < (<), > (>), " (") and ' ('). The & must be encoded first, otherwise the other entities break. Encoding the quote character is critical when attribute values are quoted.
Why is ' used instead of '?
The named entity ' is defined in HTML5 but did not exist in HTML4 and some older browsers. The numeric reference ' works in every version, so it is the safest, most portable choice for a single quote. This tool emits ' on encode.
How do I HTML-encode in .NET?
System.Net.WebUtility.HtmlEncode(string) works with no dependencies; in web projects System.Web.HttpUtility.HtmlEncode is also available. In Razor, @variable expressions automatically HTML-encode the output — printing raw HTML deliberately requires @Html.Raw.
Does this tool fully prevent XSS?
Not on its own. HTML encoding is the correct defence when printing data into an HTML body; but attribute, JavaScript, CSS and URL contexts need different escaping rules. The right approach is context-aware encoding + a Content Security Policy + input validation. This tool helps you see and verify the encoding.