Why encode HTML?
A handful of characters have special meaning in HTML: the angle brackets< and > start and end tags, &begins an entity, and quotes wrap attributes. If you display user-supplied text that contains those characters without escaping them, the browser may treat it as markup — breaking your page layout or, worse, letting an attacker inject a script (a cross-site scripting, or XSS, vulnerability). Encoding replaces those characters with safe entity codes so the text shows literally.
How to encode or decode
- Choose Encode (text → entities) or Decode (entities → text).
- Paste your content.
- Copy the result.
An example
The snippet <b>Hi & bye</b> encodes to<b>Hi & bye</b>, which displays as the literal text rather than being rendered as bold HTML.
Frequently asked questions
Which characters are escaped? The five core ones: &, <, >, " and apostrophe. Decoding handles all named and numeric entities.
Is encoding enough to prevent XSS? Escaping output is a key defence, but a full XSS strategy also depends on context (HTML, attributes, JavaScript, URLs). Use it as part of a broader approach.
Is it private? Yes — everything runs in your browser.