ToolBirch

HTML Encoder / Decoder

Escape HTML-critical characters, or decode entities back to text.Developer Tools

HTML Encoder / Decoder

Escape the five HTML-critical characters (< > & " ') to make text safe to embed, or decode named, decimal and hex entities back to text.

Encoding escapes every character that could start a tag or attribute, which prevents HTML injection when the text is inserted into markup. Decoding recognises the common named entities plus decimal (&#65;) and hex (&#x41;) forms.

About this tool

Any text that ends up inside HTML — user names, comments, generated markup — must have the angle brackets, ampersand and quotes escaped, or it becomes an injection vector. This tool encodes exactly those characters, and decodes the full entity alphabet back again.

How to use the HTML Encoder / Decoder tool

  1. Pick a direction. Encode escapes text for safe embedding; Decode resolves entities back to characters.
  2. Paste your text. The result updates as you type.
  3. Copy the output. Ready to paste into templates, attributes or code samples.

Supported formats

Input

  • Plain text
  • Text containing HTML entities

Output

  • Escaped text (&lt; &gt; &amp; &quot; &#39;)
  • Unescaped UTF-8 text

Inputs are validated before anything is processed. Invalid values and unsupported files are rejected with a clear error instead of failing silently.

Frequently asked questions

Why only five characters?

Those are the characters that can start or terminate tags and attributes. Everything else is safe as literal UTF-8, and escaping more only bloats output.

Does encoding stop XSS?

Escaping is the core defence when untrusted text is placed into HTML body or attribute context. Context matters — never place escaped text inside a script block.

Which entities are decoded?

The common named set (amp, lt, gt, quot, apos, nbsp) plus decimal and hexadecimal numeric forms.

Are unknown entities preserved?

Yes. An entity the decoder does not know is left untouched rather than being dropped.

Privacy

Everything you enter stays in this browser tab. There is no upload endpoint for tool inputs, no account, and no server-side copy of your text or files. Results are produced locally and disappear when you close the page.

No account is required and no file is ever uploaded. See the privacy policy for details about analytics and the limited data this site stores.

Known limitations

  • Encoding covers the five critical characters, not the full named-entity alphabet.
  • Decoding recognises a practical subset of named entities plus all numeric forms.
  • This is not a full HTML sanitiser for whole documents.

Related tools

Other free tools from the same collection.

URL EncoderPercent-encode or decode text and URLs, with strict and permissive modes.Markdown PreviewRender Markdown to sanitized HTML with live styling.XML FormatterIndent XML for readability and verify tags close in order.Base64 Encoder / DecoderEncode text to Base64 or decode it back, with correct UTF-8 handling.