HTML Entity Encoder / Decoder
Escape & unescape HTML safely.
Runs entirely in your browser — nothing you enter is uploaded, logged, or tracked.
Convert characters like &, <, >, and quotes into their HTML entities so they display as text instead of markup — or decode entities back. Essential for safe output.
Frequently asked questions
Why escape HTML?
Escaping turns markup characters into harmless entities so user content renders as text rather than being interpreted as HTML — the core defence against stored XSS.
Which characters get encoded?
The HTML-significant ones — & < > " and ' — plus an option to escape all non-ASCII characters as numeric entities for maximum compatibility.