HTML Entity Encoder & Decoder

About this tool

HTML uses characters such as <, >, & and quotes as part of markup syntax. When those characters are meant to appear as text, they need to be represented safely. The HTML Entity Encoder and Decoder converts special characters to entities and restores entity text to readable characters.

Encoding is especially important when displaying code snippets or user-provided text, but entity conversion alone is not a complete defense against cross-site scripting. Applications should escape output for the exact HTML, attribute, URL or JavaScript context and avoid treating untrusted strings as markup. Use this utility for inspection and preparation; use your framework's context-aware escaping functions in production templates. For percent-encoded URL parameters, the Query String Parser is the more appropriate tool.

How to use it

1. Select Encode when literal text must be displayed safely inside HTML content.
2. Select Decode when you need to inspect text containing named or numeric entities.
3. Enable non-ASCII encoding only when the target system requires an ASCII-only representation.
4. Convert the text and verify that quotes, ampersands and angle brackets behave as expected.
5. Use context-aware application escaping when the value will be inserted into a live template.

Useful ways to apply it

• Displaying HTML tags as code instead of allowing the browser to parse them.
• Decoding copied content that contains & or numeric entities.
• Preparing examples for documentation, tutorials and support messages.
• Checking whether text has been encoded once or accidentally double-encoded.
• Learning which characters have special meaning in markup.