HTML Encoder & Decoder - Escape HTML Entities Online
Encode special characters to HTML entities or decode HTML entities back to text. Prevent XSS vulnerabilities — 100% client-side processing.
Frequently Asked Questions
What is HTML encoding?
HTML encoding (also called HTML escaping) converts special characters like <, >, &, ", and ' into their HTML entity equivalents (<, >, &, ", '). This prevents browsers from interpreting them as HTML markup, ensuring they display as literal text.
How do I use this HTML Encoder tool?
Enter or paste text in the input field. Select Encode mode to convert text to HTML entities, or Decode mode to convert entities back to text. Choose your preferred entity format (Named, Decimal, or Hex) and encoding mode (Minimal for reserved chars only, or Full for non-ASCII too). Results appear in real-time.
Is my data secure?
Yes. All processing happens 100% in your browser. No data is ever sent to any server. You can verify this by disconnecting from the internet — the tool will continue to work. This makes it safe for encoding sensitive data.
How does HTML encoding prevent XSS attacks?
XSS attacks inject malicious scripts into web pages. HTML encoding converts characters like < and > into harmless entities (< and >), so the browser displays them as text rather than executing them. For example, <script>alert('XSS')</script> becomes <script>alert('XSS')</script>.
What is the difference between Named, Decimal, and Hex entities?
Named entities use descriptive names (<, &, ©). Decimal entities use Unicode code points (<, &). Hex entities use hexadecimal code points (<, &). All three formats are valid HTML and render identically. Named entities are more readable; numeric entities can represent any Unicode character.
Code Examples
// HTML Encode (minimal)
function encodeHtml(text) {
const entities = { '&': '&', '<': '<', '>': '>', '"': '"', "'": ''' };
return text.replace(/[&<>"']/g, c => entities[c]);
}
// HTML Decode
function decodeHtml(encoded) {
const textarea = document.createElement('textarea');
textarea.innerHTML = encoded;
return textarea.value;
}
console.log(encodeHtml('<script>alert("XSS")</script>'));
// <script>alert("XSS")</script>
console.log(decodeHtml('<div>Hello & World</div>'));
// <div>Hello & World</div>