HTML Encode/Decode
Encode special characters to HTML entities or decode them back.
The 5 Characters You Should Encode
These are the characters that cause problems in normal HTML when left unencoded:
- < becomes < so the browser does not read it as the start of a tag
- > becomes > so the browser does not treat it as the end of a tag
- & becomes & so it does not start a broken entity
- " becomes " inside double-quoted attributes
- ' becomes ' inside single-quoted attributes
Why HTML Encoding Is a Security Issue
Without encoding, user input can turn into Cross-Site Scripting (XSS). For example, a comment might contain <script>alert("test")</script>. If you print that comment as real HTML, the browser may run it. HTML encoding turns the angle brackets into text, so the code is displayed instead of executed.
XSS is a common web security risk. Encoding on output is one of the basic habits that keeps user-generated text from becoming executable code.
Encoding on Output, Not Input
A common mistake is encoding data when you receive it and storing the encoded version. Don't do that. Store the raw data and encode it right before you render it in HTML. Why? Because the same data might be used in an API response, a mobile app or an email where HTML entities don't make sense. Encode at the last possible moment.
When HTML Encoding Isn't Enough
HTML encoding protects you inside normal HTML content. It is not enough if you put user data inside a <script> tag, a CSS style block, an event handler attribute or a URL. Each context needs its own type of escaping. Modern frameworks like React, Angular and Vue handle most normal text output automatically.
How to Use
- Paste your text or HTML entities into the input area.
- Click Encode to turn special characters into HTML entities.
- Click Decode to convert HTML entities back to normal characters.
- Copy the result.
Frequently Asked Questions
What is an HTML entity?
It's a way to represent special characters in HTML using a code that starts with & and ends with ;. For example, &lt; shows a < symbol on the page without the browser treating it as an HTML tag.
Does HTML encoding prevent XSS attacks?
It's one important layer of defense, but not a complete solution by itself. HTML encoding stops the browser from interpreting user input as executable code within normal HTML content. But you also need server-side encoding, Content Security Policy headers and proper handling of other contexts like JavaScript and URLs.
Should I encode data before storing it in a database?
Store the raw data and encode on output, right before rendering into HTML. Encoding before storage locks the data into an HTML-only shape - it comes out garbled in APIs, mobile apps and anywhere else that isn't a web page.
Why do frameworks like React auto-escape content?
React, Angular and Vue automatically encode user data before inserting it into the DOM. This prevents XSS by default. You'd have to go out of your way (like using React's dangerouslySetInnerHTML) to bypass this protection.
What's the difference between named and numeric entities?
Named entities use a readable name like &amp; for &. Numeric entities use the Unicode code point, like &#38; for the same character. They produce identical results. Named entities are easier to read but not every character has a named version.