Encode special characters to HTML entities or decode HTML entities back to text.
Escape HTML safely
HTML encoding converts special characters like <, >, & into HTML entities to prevent XSS attacks and display HTML code as text. Decoding reverses this process.
& → &< → <> → >" → "The HTML Encoder/Decoder converts text to and from HTML entities, so characters like <, >, &, and quotation marks display literally instead of being parsed as markup. Reach for it when you need to safely embed user content or code samples inside a page, or when you have to read encoded text back into plain form. It runs entirely in your browser, so the text you paste never leaves your device.
It replaces reserved characters with HTML entities, for example < becomes <, > becomes >, and & becomes &. The browser then renders the literal characters instead of interpreting them as tags or markup.
Encode when you want to display raw HTML, code, or user input as visible text on a page. Decode when you have entity-escaped text (such as content from a database or an export) and need to read or reuse it in its original form.
Escaping HTML entities is a core defense that stops markup from being interpreted, which is the foundation of output encoding. For production security you should still encode on the server at the correct output context and follow a complete XSS prevention strategy rather than relying on a single client-side step.
Yes. The tool runs 100% client-side in your browser. Nothing you paste is uploaded, sent to a server, stored, or tracked, so it is safe to use with internal or sensitive text.
Yes, the HTML Encoder/Decoder is completely free with no sign-up, no limits, and no watermarks.
We use minimal, privacy-focused cookies to improve your experience. Our developer tools process all data locally — we never store your content. Learn more