HTML Encode / Decode
Encode or decode HTML entities instantly. Runs in your browser — no data sent to server.
About the HTML Encoder
This tool HTML encodes text by converting the characters that carry special meaning in markup — angle brackets, ampersands and quotes — into entities, so the text displays exactly as written rather than being interpreted as HTML by the browser.
To HTML encode text is to make it displayable as markup on a page instead of being rendered as it. Writing about a div element requires the angle brackets to become < and >, otherwise the browser treats them as a tag and the text disappears from view.
The same mechanism is the foundation of preventing cross-site scripting. When user input is written into a page without encoding, a submitted script tag becomes an executing script. Encoding the angle brackets turns it into visible harmless text — which is why output encoding is the standard XSS defence.
Five characters carry special meaning and need encoding: the ampersand, less-than, greater-than, double quote and apostrophe. The ampersand must be encoded first, since it introduces every other entity — encode it last and you double-encode everything else.
How to use the HTML Encoder
- Paste your text. Enter the text or markup to encode.
- Encode it. Special characters are converted to HTML entities.
- Check the output. Confirm ampersands and brackets were escaped correctly.
- Copy the result. Paste the encoded text into your page or template.
HTML Encoder features
- Encodes the five reserved HTML characters
- Correct ampersand handling to avoid double encoding
- Optional encoding of non-ASCII characters
- Decoding available in the same tool
- Instant results as you type
- Runs entirely in your browser
Frequently asked questions
Which characters need HTML encoding?
Five: the ampersand, less-than, greater-than, double quote and apostrophe. All have structural meaning in markup.
Why must the ampersand be encoded first?
It introduces every other entity. Encoding it last would double-encode the entities you just created.
Does HTML encoding prevent XSS?
Encoding output is the standard defence. It turns a submitted script tag into visible harmless text rather than executing code.
How do I show HTML code on a page?
Encode it. The angle brackets become entities so the browser displays the markup instead of rendering it.
Can I decode entities here too?
Yes, both directions are available, and the HTML decoder page covers decoding specifically.