How to Use
Paste Your Text or HTML
Enter the content you want to encode or decode — HTML code, special characters or entity-encoded text.
Choose Encode or Decode
Encode converts special characters to HTML entities. Decode reverses the process.
Convert Instantly
Result appears immediately.
Copy Result
Copy the encoded or decoded HTML to use in your project.
About This Tool
HTML has characters with special meaning — angle brackets create tags, ampersands start entities, quotes delimit attributes. When you need to display these as literal text rather than HTML markup, you need HTML encoding. Get it wrong and you create broken layouts, security vulnerabilities or text that does not display as intended.
The Core HTML Special Characters
Five characters almost always need encoding when you want to display them literally.
< becomes < — without encoding, browsers interpret this as the start of an HTML tag. > becomes > — used to close HTML tags. & becomes & — the start character for all HTML entities. " becomes " — needed inside double-quoted HTML attributes. ' becomes ' — for single-quoted attributes.
The Security Reason You Must Encode User Input
Cross-Site Scripting (XSS) is one of the most common web security vulnerabilities. It occurs when user-supplied text is displayed without encoding. If a user types <script>steal_cookies()</script> in a comment field and your app displays it unencoded, browsers execute the script. With proper encoding, it becomes <script> which browsers display as plain text — never executing it.
Every web application that displays user-supplied content must HTML-encode it before rendering. This is not optional — it is a fundamental security requirement.
Practical Uses
Displaying code examples on websites requires encoding — every < and > in code examples must be encoded to display as text rather than HTML. Email content with HTML must be properly encoded. CMS platforms accepting user input must encode before display.
Why Use This Tool?
XSS Prevention
Encode user input to prevent Cross-Site Scripting attacks.
All HTML Entities
Handles all special characters including Unicode.
Encode and Decode
Both directions — full encode and decode support.
Always Free
No account needed. Encode unlimited HTML free.
Related Tools
Frequently Asked Questions
XSS (Cross-Site Scripting) occurs when malicious code is injected through user input displayed without encoding. HTML encoding converts <script> to <script> which browsers display as text, never executing it as code.