HTML Encoder / Decoder
Encode and decode HTML entities online. Convert special characters to HTML entities and vice versa.
About this calculator
Encode HTML special characters to entities and decode entities back. A sample string is loaded so you can see the effect at once.
Buttons let you clear the box and copy the output.
How to use it
- Paste your text.
- Press Encode HTML or Decode HTML.
- Press Copy Output.
Entities
HTML reserves a few characters. To show them as text, replace them with entities: & becomes &, < becomes <, > becomes >, " becomes " and ' becomes '. Encoding user-supplied text before inserting it into a page is a core defence against cross-site scripting (XSS).
Worked example
Example
| <h1>Hello & welcome</h1> | <h1>Hello & welcome</h1> |
Runs entirely in your browser. Nothing you paste is uploaded.
Tips and common mistakes
- Always encode user input before putting it in HTML.
- Encode the ampersand first when doing it by hand.
- Attribute values also need quotes encoded.
- Use a template engine that escapes by default.
- Entities are different from URL encoding. Don't mix them.
Frequently asked questions
What is an HTML entity?
A text code, like &, that stands for a special character.
Why encode HTML?
To display markup as text and to prevent XSS.
What does mean?
A non-breaking space.
What is the difference from URL encoding?
URL encoding uses %XX codes, HTML uses & codes.
Can I decode too?
Yes, use the Decode button.
Is it safe for XSS prevention?
Encoding on output is one part of a safe approach.