HTML Encoder/Decoder - Free Online Tool

Last updated March 22, 2026

What is HTML Encoding?

HTML encoding converts special characters into HTML entities to prevent XSS (Cross-Site Scripting) attacks and display reserved HTML characters correctly. Characters like <, >, &, ", and ' have special meanings in HTML and must be encoded as <, >, &, ", and ' to be displayed as text rather than interpreted as HTML code. Our HTML encoder protects your web applications from injection attacks by sanitizing user input, and helps display code snippets, special characters, and symbols correctly on web pages. The tool supports both named entities ( ) and numeric entities ( ), with automatic detection of input format.

When to Encode vs Sanitize

• Encoding — use when displaying plain text content. Converts all special characters to entities. No HTML allowed.
• Sanitizing — use when you need to allow some HTML (like a rich text editor). Strips dangerous tags/attributes while keeping safe ones. Use a library like DOMPurify.
• Never build your own HTML sanitizer — use a well-tested library.
• Always encode output, not just input — encode at the point of insertion into HTML.

All encoding and decoding happens in your browser. Your content is never sent to any server.

Why Use HTML Encoding?

Unencoded user input is the #1 cause of XSS attacks where hackers inject malicious scripts into web pages. HTML encoding prevents these attacks by converting dangerous characters into safe entities that browsers display as text, not code. It's essential for displaying user-generated content (comments, reviews, forum posts), showing code examples, rendering special characters (©, ®, €), and preventing HTML injection. Without proper encoding, attackers can steal cookies, hijack sessions, deface websites, and compromise user data. Modern web frameworks automatically encode output, but manual encoding is often needed for legacy systems, APIs, and special cases.

How to Use

1. Paste your text or HTML code into the input field
2. Click 'Encode HTML' to convert special characters to entities
3. Copy the encoded text for safe display in HTML
4. To decode, paste HTML entities and click 'Decode HTML'
5. View the original text with special characters restored

Real-World Examples

Input text:
  <script>alert('XSS')</script>

HTML encoded output:
  &lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;

When rendered in a browser, this displays as literal text:
  <script>alert('XSS')</script>

Instead of executing as JavaScript — the attack is neutralized.

---

Essential HTML entity reference:
  <  →  &lt;
  >  →  &gt;
  &  →  &amp;
  "  →  &quot;
  '  →  &#39; or &apos;
  /  →  &#x2F; (recommended in some contexts)

// ❌ VULNERABLE — never do this
app.get('/comment', (req, res) => {
  const userComment = req.query.text;
  res.send(`<p>${userComment}</p>`); // XSS vulnerability!
});

// Attacker URL:
// /comment?text=<script>document.cookie</script>

// ✅ SAFE — encode before inserting into HTML
function htmlEncode(str) {
  return str
    .replace(/&/g, '&amp;')
    .replace(/</g, '&lt;')
    .replace(/>/g, '&gt;')
    .replace(/"/g, '&quot;')
    .replace(/'/g, '&#39;');
}

app.get('/comment', (req, res) => {
  const userComment = htmlEncode(req.query.text);
  res.send(`<p>${userComment}</p>`); // Safe!
});

// Python equivalent:
import html
safe_comment = html.escape(user_comment)

// PHP:
$safe_comment = htmlspecialchars($user_comment, ENT_QUOTES, 'UTF-8');

// Attribute context requires encoding quotes
// to prevent breaking out of the attribute value

// ❌ VULNERABLE
const title = req.query.title; // User input: " onmouseover="alert(1)
const html = `<div title="${title}">...</div>`;
// Renders as: <div title="" onmouseover="alert(1)"> ← attribute injection!

// ✅ SAFE — encode quotes in attribute values
const safeTitle = title.replace(/"/g, '&quot;');
const html = `<div title="${safeTitle}">...</div>`;

// Even safer — use single quotes and encode both:
function encodeAttribute(str) {
  return str
    .replace(/&/g, '&amp;')
    .replace(/"/g, '&quot;')
    .replace(/'/g, '&#39;')
    .replace(/</g, '&lt;')
    .replace(/>/g, '&gt;');
}

// Example:
Input:  She said "hello" & he said 'goodbye'
Output: She said &quot;hello&quot; &amp; he said &#39;goodbye&#39;