What is a HTML Encoder / Decoder?
HTML has a handful of characters — <, >, &, ", and ' — that have special meaning in markup, since they're used to define tags and attributes. If you want one of those characters to display literally on a page rather than being interpreted as markup (for example, showing a code snippet that includes a <div> tag as visible text), it needs to be replaced with its corresponding HTML entity, like < for < and & for &. This tool converts text to its escaped entity form, or reverses already-escaped entities back into readable characters.
When to use it
This is essential when displaying code examples or raw HTML/XML on a webpage without it actually rendering as markup — documentation sites, blog posts about code, and comment systems all need this to show a < character as text instead of starting a tag. It's also a basic building block of preventing cross-site scripting (XSS): escaping user-submitted content before displaying it back on a page prevents an attacker from injecting a <script> tag that the browser would otherwise execute.
How it works
Encoding works via direct character substitution — this tool replaces each of the five HTML-significant characters (<, >, &, ", ') with its named entity equivalent (<, >, &, ", '). Decoding reverses this by rendering the entities in an off-screen element and reading back the resulting text content, which correctly handles both named entities (&) and numeric entities (&), since browsers natively understand both forms.
Frequently asked questions
Is HTML-encoding user input enough to prevent XSS attacks?
It's an important part of the defense, but not the whole picture — proper XSS prevention depends on context (encoding differs for HTML body text, attribute values, JavaScript strings, and URLs) and should be handled by your framework's built-in escaping rather than manual encoding alone. Treat this tool as useful for display purposes and learning, not as a substitute for a framework's security features in production code.
What's the difference between & and &?
They represent the same character (&) — & is the named entity, easier to read, while & is the numeric entity using the character's decimal code point. Browsers treat them identically; named entities are generally preferred for readability where they exist.
Why does my decoded HTML still show entity codes instead of the actual characters?
This usually means the entities are double-escaped — the & in an entity like & was itself escaped to &amp; at some point. Try decoding a second time, or check where the double-escaping happened in your original process.