HTML Entity Encoder / Decoder
Encode and decode HTML entities for safe markup embedding.
Sensitive data: Anything you enter is processed in your browser only. It is never uploaded or logged on a server.
HTML entity encoding and decoding
HTML entities prevent user content from breaking markup or executing scripts. Encode ampersands, quotes, and angle brackets before inserting untrusted strings into templates. Decoding helps when CMS exports double-encoded article bodies.
Named entities (&) versus numeric (') differ in browser support for rare codepoints. Attribute context needs quote escaping even when body context does not.
Encoding is not sufficient XSS protection alone. Combine with Content Security Policy and contextual output escaping in frameworks.
Encode untrusted snippets locally before pasting into wiki or email HTML. Keeps raw input off remote entity converter sites.
Reference Guide
Security tool - all processing runs locally in your browser. No data is sent to a server.
Operation: html-encode
Paste input, click Run, and copy the result. For two-input tools, fill both fields before running.
Example Input
<div>& "quote"
A sample loads automatically when you open this tool. Use Load Sample to reset it.