HTML Encoder / Decoder

About the HTML Encoder / Decoder

This HTML encoder / decoder runs entirely in your browser. Type or paste text into the input box, then click Encode to convert characters like <, >, & and quotes into HTML entity references, or Decode to turn entity references back into plain characters. Nothing is uploaded to a server — the conversion happens instantly with JavaScript on your device.

What HTML encoding does

In HTML, certain characters have special meaning. The less-than sign < starts a tag, the greater-than sign > ends a tag, the ampersand & begins an entity reference, and quotes " ' delimit attribute values. If you want to display these characters as literal text on a web page, they must be escaped as entity references:

• & becomes &
• < becomes <
• > becomes >
• " becomes "
• ' becomes '

This tool encodes exactly those five characters, which is the standard set needed to safely embed arbitrary text inside HTML.

When to use HTML encoding

• Displaying code in HTML — If you want to show an HTML snippet like <div class="box"> as visible text in a tutorial or blog post, you must encode the angle brackets and quotes so the browser does not interpret them as real tags.
• Preventing XSS — When you insert user-supplied or external data into a web page, encoding prevents cross-site scripting (XSS). A malicious input like <script>alert(1)</script> is rendered as harmless visible text instead of being executed.
• Embedding data attributes — Values placed inside HTML attributes should have their quotes encoded so they cannot break out of the attribute.

How to use the converter

1. Paste or type your text in the input box.
2. Click Encode to escape the five special characters into entities, or Decode to convert entities back to characters.
3. Click Swap to move the output into the input box and clear the output, so you can run the opposite operation.
4. Click Copy output to copy the result to your clipboard, or Clear to start over.

Frequently asked questions

Does this tool upload my text? No. All conversion happens locally in your browser. Your text never leaves your device.

Which characters are encoded? The encoder escapes &, <, >, " and ' — the five characters that have special meaning in HTML. Other characters are left untouched.

Can I decode all entity types? The decoder handles named entities (like <, "), decimal numeric entities (like <), and hexadecimal entities (like <), using the browser's built-in HTML parser for accuracy.

Is this enough to prevent XSS on its own? Encoding the five special characters is the standard defense for inserting text into HTML element content. However, if you insert data into other contexts (such as inside a <script> block, a URL, or a style attribute), you may need additional escaping rules specific to that context.