HTML Entity Encoder / Decoder
Convert special characters to HTML entities (& < > etc.) and back. Handles named entities, numeric entities and full document encoding.
What is the HTML Entity Encoder / Decoder?
The HTML Entity Encoder converts special characters into their HTML entity equivalents — for example, transforming < into < and & into & — and reverses the process in decode mode. This is a critical operation in web development and security engineering because inserting raw user-generated content directly into HTML without encoding is the primary cause of Cross-Site Scripting (XSS) vulnerabilities, one of the most exploited classes of security bugs on the web.
HTML entity encoding is also essential when writing HTML documentation, embedding code samples in web pages, or working with template engines that generate HTML output. Knowing which characters must be encoded and when to encode them is a foundational web security skill for any developer building applications that display user input, parse third-party data, or render dynamic content in a browser.
When to Use This Tool
- XSS prevention testing: Encode user-supplied strings before pasting them into HTML templates to verify that your application would display the content safely without executing any embedded scripts.
- Embedding code samples in HTML: Encode angle brackets and ampersands in code examples so they display as literal text in a browser rather than being interpreted as HTML tags.
- Debugging template engine output: Decode entity-encoded strings from an API response or template output to see what the original content was before the encoding was applied.
- Email HTML authoring: Encode special characters in HTML email templates, which have stricter rendering environments than modern browsers and require proper entity encoding for consistent display across email clients.
How It Works
Encoding replaces the five HTML-critical characters — ampersand (&), less-than (<), greater-than (>), double quote ("), and single quote (') — with their named or numeric HTML entity equivalents using simple string replacement. Decoding takes the reverse path by assigning the entity-encoded string as the innerHTML of a temporary <textarea> element and reading back the value property, which the browser automatically decodes. This approach leverages the browser's own HTML parser for decoding, ensuring correct handling of all named and numeric entities without maintaining a full entity lookup table.
Example Walkthrough
Suppose a support ticket form lets users paste raw text that gets rendered directly into an admin dashboard. A user submits the string:
Please fix the