HTML Encoder & Decoder
Encode special characters to HTML entities or decode entities back to plain text. Prevents XSS attacks and ensures safe display of content in HTML pages.
<script>alert("XSS")</script>
Common HTML entities
What are HTML Entities?
HTML entities are special sequences that represent characters which have meaning in HTML syntax. For example, the < character starts an HTML tag, so to display it as text you must encode it as <. Similarly, & must be encoded as& because it starts entity references.
There are three formats: named entities (&),decimal entities (&), and hex entities (&). All produce the same output character.
Common HTML Entities Reference
| Character | Named | Decimal | Hex | Description |
|---|---|---|---|---|
& | &amp; | &#38; | &#x26; | Ampersand |
< | &lt; | &#60; | &#x3C; | Less-than |
> | &gt; | &#62; | &#x3E; | Greater-than |
" | &quot; | &#34; | &#x22; | Double quote |
' | &apos; | &#39; | &#x27; | Single quote / apostrophe |
© | &copy; | &#169; | &#xA9; | Copyright |
— | &mdash; | &#8212; | &#x2014; | Em dash |
€ | &euro; | &#8364; | &#x20AC; | Euro sign |
When to Encode vs Decode
Encode when inserting user-supplied text into HTML — form inputs, comments, database content displayed on pages. This prevents Cross-Site Scripting (XSS) attacks.
Decode when you receive HTML-encoded text and need the original characters — for example, parsing RSS feeds, processing API responses, or extracting text from HTML documents.