HTML Encoder / Decoder
Encode and decode HTML entities online. Convert special characters like <, >, & to HTML entities.
About this calculator
Convert special characters such as <, > and & to HTML entities, or decode entities back to text. Paste, press Encode or Decode, and copy.
Used to display code samples on web pages and to sanitise text for insertion into HTML.
How to use it
- Paste your text.
- Press Encode or Decode.
- Press Copy.
Entities
HTML reserves a few characters. To show them as text, replace them with entities: & becomes &, < becomes <, > becomes >, " becomes " and ' becomes '. Encoding user-supplied text before inserting it into a page is a core defence against cross-site scripting (XSS).
Worked example
Example
| <h1>Hello & welcome</h1> | <h1>Hello & welcome</h1> |
Runs entirely in your browser. Nothing you paste is uploaded.
Tips and common mistakes
- Always encode user input before putting it in HTML.
- Encode the ampersand first when doing it by hand.
- Attribute values also need quotes encoded.
- Use a template engine that escapes by default.
- Entities are different from URL encoding. Don't mix them.
Frequently asked questions
What is an HTML entity?
A text code, like &, that stands for a special character.
Why encode HTML?
To display markup as text and to prevent XSS.
What does mean?
A non-breaking space.
What is the difference from URL encoding?
URL encoding uses %XX codes, HTML uses & codes.
Can I decode too?
Yes, use the Decode button.
Is it safe for XSS prevention?
Encoding on output is one part of a safe approach.