HTML Entity Encoder and Decoder
Turn `<script>` into `<script>` so it displays as text instead of running, or decode `&#8212;` back into an em dash. Named, decimal and hexadecimal references are all supported.
Minimal escaping is usually what you want
Only five characters actually need escaping in HTML: `&`, `<`, `>`, `"` and `'`. Escaping those makes any string safe to place in markup or an attribute. Escaping everything else is legacy behaviour from the days of unreliable encoding declarations, and only makes the source harder to read.
When to escape non-ASCII too
If a document must survive a pipeline that mangles UTF-8 - an old CMS, an email template, a system with an unknown charset header - full escaping guarantees the characters arrive intact. You can choose named references such as `©` where one exists, or numeric references for everything.
Decoding what a system stored
Double-escaped text (`&amp;`) is a common bug: two layers of code both escaped the same string. Decoding once shows `&`, decoding twice shows `&`. Seeing that is the quickest way to confirm the diagnosis before removing the extra escaping step at the source.
Frequently asked questions
Is my text sent to a server?
No. Nothing you paste leaves your browser. The page loads a small amount of JavaScript, and every calculation happens on your own machine - there is no server to send data to. The encoder and decoder are small pure functions that do not touch the DOM or the network.
Does escaping HTML prevent XSS?
Escaping the right characters in the right context is the core of the defence, but context matters: text content, attribute values, URLs and inline JavaScript each need different treatment. Use your framework's built-in escaping, which knows the context, and treat this tool as an inspection aid rather than a security boundary.
Why does ` ` look like a normal space?
It is a non-breaking space - visually identical but it prevents a line break and is a different character. It often sneaks in from word processors and rich text editors, and is a frequent cause of layouts that will not wrap where you expect.
Should I use `'` for a single quote?
`'` is valid in HTML5 and XML but was not defined in HTML 4, so very old parsers may not recognise it. `'` is universally safe. If you are targeting anything ancient, prefer the numeric form.