How to use the HTML Entity Encoder
1. Choose Encode to convert special characters to HTML entities, or Decode to reverse it.
2. Paste your text and the result appears instantly.
3. Use Encode before inserting user content into HTML to prevent XSS vulnerabilities.
What is it?
HTML entity encoding converts special characters (&, <, >, ") into their safe HTML entity equivalents. This is critical for web security — failing to encode user-supplied text before rendering it in HTML can lead to Cross-Site Scripting (XSS) attacks.
For example, if a user types <script>alert('hack')</script> in a form, and you render it directly in HTML, the script executes. Encoding turns the angle brackets into < and >, making them display as text rather than tags.
Benefits
Prevent XSS by encoding user content before rendering in HTML
Encoded output cannot execute as HTML or JavaScript — <script> displays as text, not as an executable tag.
Display code examples safely in HTML pages
Encode <script>, <div>, and template tags to show them as visible text rather than interpreted markup.
Decode HTML entities in scraped or third-party content
Convert &, <, ©, and back to readable characters before processing or storing extracted content.
Prepare user-submitted text for safe database storage
Encode on input to prevent injection vulnerabilities when the text is later rendered back into an HTML page.
Frequently asked questions
What is XSS and why does encoding prevent it?
XSS (Cross-Site Scripting) is an attack where malicious scripts are injected into web pages. HTML encoding ensures angle brackets and quotes are treated as text, not markup, making injected scripts inert.
Which characters are encoded?
The five main characters: & → &amp;, < → &lt;, > → &gt;, " → &quot;, ' → &#39;
Is this tool safe for passwords?
Processing happens entirely in your browser. No data is sent to any server.