HTML Entity Encoder
Safely encode special characters into HTML entities to prevent XSS attacks, or decode messy HTML entities back into readable plain text.
How to Use
- Paste your text, source code, or messy HTML string into the left panel.
- Click Encode Entities to convert dangerous HTML tags (like
<and>) into safe, displayable characters. - Click Decode Entities if you have a string full of `<` and ` ` that you want to convert back into readable plain text.
- Use the dropdown to select Extended Mode if you also want to encode copyright symbols, currencies, and foreign characters into their numerical HTML counterparts.
Features
XSS Prevention
Strictly encodes malicious script tags to neutralize cross-site scripting vulnerabilities.
Two-Way Tool
Flawlessly decodes heavy entity strings back into native UTF-8 plain text.
Browser Safe
Uses the native DOMParser engine to safely decode strings without executing them.
Privacy First
Your code never leaves your computer. Everything runs locally in JavaScript.
Use Cases
- Displaying Code: If you are building a coding blog or tutorial site, you must encode your code snippets. Otherwise, the browser will try to execute the
<div>tags instead of displaying them to your readers. - Security (Sanitization): Before saving user input (like forum comments) to a database, developers encode the HTML to prevent users from injecting malicious JavaScript payloads.
- Data Cleaning: Often, data scraped from websites or old APIs will be littered with `&` and `"`. Use the decoder to clean the text before importing it into a spreadsheet.
What are HTML Entities?
In HTML, certain characters are "reserved". For example, the less-than sign (<) and greater-than sign (>) are strictly used to create HTML tags. If you want to actually display a less-than sign in a mathematical equation on your webpage, the browser will get confused and think you are starting a tag.
To solve this, you use an HTML Entity. An entity begins with an ampersand (&) and ends with a semicolon (;). By typing <, the browser knows to display a literal less-than sign without executing it as code.
The Web Developer Suite
If you are trying to encode a URL instead of standard text, use our URL Encoder. For converting structural code, try the HTML Formatter or test your safely encoded scripts in the Online Code Editor. Need to convert the output into a base64 string? We have a Base64 Tool for that too.
Frequently Asked Questions
What is the difference between Strict and Extended mode?
Strict mode only encodes characters that break HTML or cause security issues: <, >, &, ", and '. Extended mode converts almost all non-alphanumeric characters (like emojis, math symbols, and foreign accents) into their numerical entity format (e.g., ©).
Is this the same as URL Encoding?
No. URL encoding (which uses % signs like %20 for space) is specifically for transmitting data inside a web address. HTML encoding is for safely displaying text inside the body of a webpage.
Will the Decoder execute malicious scripts?
No. This tool utilizes the modern DOMParser API, which parses the HTML string into a virtual, inert document. It safely extracts the text without executing any embedded JavaScript.
Is the data sent to a server?
No, all parsing happens securely in your web browser.
Is it free?
Yes, 100% free with no limits.