HTML Entity Encoder Decoder

How This Tool Works

The HTML Entity Encoder/Decoder converts special characters to and from their HTML entity equivalents. Characters like <, >, &, and " have special meaning in HTML and must be escaped as <, >, &, and " when they appear as content rather than markup. Failure to encode user-provided content before inserting it into HTML is the most common cause of Cross-Site Scripting (XSS) vulnerabilities. The decoder converts entity-encoded text back to readable form.

How to Use

1. To encode: paste text containing <, >, &, or quotes in field A, click Run — the HTML-safe entity version is returned.
2. To decode: paste HTML-encoded text (with <, > etc.) in field A, click Run — the readable text is returned.
3. Always encode user-provided content before rendering it in HTML to prevent XSS.
4. The encoder handles both named entities (&) and numeric entities (&).

Common Questions