Text Tools
Image Tools
PDF Tools
Social Media Tools
Security Tools
Coding Tools
CSS Tools
Color Tools
Miscellaneous Tools
Add to Chrome
Add to Firefox
Escapes the 5 characters that break markup — and unescaped input is how cross-site scripting gets in.
What is Online HTML Encoder/Decoder?
HTML Encoder/Decoder is a free online tool for encoding and decoding HTML entities. If you want to store or use HTML entities and don't want to get in trouble in any way, you should encode them. In HTML encode, <, >, ", ', &, ` and unprintable ASCII characters are converted into character codes.
As shown in the table, characters converted into character codes for escaping. It prevents the text or string to process as an HTML entity. For example, if you have a div with text in it. This HTML will be encoded like this.
Raw HTML: <div>Text</div>
Encoded: <div>Text</div>
How to use Online HTML Encoder/Decoder?
You can encode and decode HTML entities by following these steps.
- Enter the text you want to encode or decode.
- Click the buttons "Encode" or "Decode" to convert your HTML entity or Encoded string.
- You can copy the encoded or decoded text by manually or by using the "Copy" button. If you want to reset all inputs and outputs and start from scratch, use "Reset" button.
Frequently asked questions
Which characters need encoding?
The five that mean something to the parser: < and > because they open and close tags, & because it starts an entity, and the quote marks because they delimit attribute values.
Why does it matter?
Because unencoded user input is how cross-site scripting happens. If someone types a script tag into a comment field and it reaches the page unescaped, the browser runs it. Encoding turns it into text to be displayed rather than code to be executed.
Is encoding enough to be safe?
It is the right first step, but context matters. Encoding for HTML text is not the same as encoding for an attribute, a URL or inline JavaScript, and a value escaped for the wrong one can still be exploitable. Escape for the place the value is going.
Why has my entity come out as &amp;?
Double encoding — the text was already escaped once and has been through again, so the ampersand of the first entity got escaped too. Decode once and re-encode rather than encoding twice.
What about URLs?
Different rules entirely. The URL Encoder/Decoder escapes the characters reserved in a URL, which is a separate set from the HTML ones.
