HTML Encoder / Decoder
Encode special characters to safe HTML entities, or decode HTML entities back to readable text — instantly in your browser.
Disclaimer. This tool is provided for informational purposes only. Always verify that user-supplied content is properly escaped before deploying to production. Read full disclaimer →
About HTML Encoder and Decoder
HTML encoding converts special characters to their HTML entity equivalents to prevent browser misinterpretation. Critical characters: less-than sign becomes <, greater-than sign becomes >, ampersand becomes &, double quote becomes ", and single quote becomes ' or '. This prevents content from being interpreted as HTML tags.
Why it matters: Cross-Site Scripting (XSS) attacks inject malicious scripts via unencoded user input that the browser executes as HTML. Always HTML-encode user-supplied content before inserting it into HTML pages. Modern frameworks like React and Angular do this automatically, but raw string concatenation in older code or email templates is vulnerable. Use this tool to safely embed code examples in web pages, encode email template content, or verify that your application is properly escaping user input before display.
Frequently Asked Questions
< becomes <, > becomes >, & becomes &, " becomes ", and ' becomes '.') back to their corresponding characters.