How to use the HTML Entity Encoder / Decoder
- Paste text or HTML.
- Click Encode, Encode non-ASCII or Decode.
- Copy the output.
About this tool
Characters like <, > and & have special meaning in HTML. To show them literally — in a code sample, a tooltip or user-generated content — they must be written as entities such as <. Failing to escape user input is the root cause of cross-site scripting (XSS), one of the most common web vulnerabilities.
Encode escapes the five critical characters. Encode non-ASCII too additionally converts characters like “é” or “—” into numeric entities, useful for systems that mangle UTF-8. Decode turns entities back into plain text.
Frequently asked questions
Is escaping enough to stop XSS?
It's essential for HTML text content, but attributes, URLs and JavaScript contexts need context-specific encoding. Use your framework's templating.
What's the difference between &nbsp; and a space?
is a non-breaking space that prevents line wraps.