HTML Entities Encode / Decode
Escape text for HTML and turn entities back into text.
About this tool
Escape <, >, &, quotes and optionally every non-ASCII character so text is safe to put into HTML, or decode named and numeric entities like &, é and 🚀 back into plain text.
How to use it
- Choose Encode to escape text for HTML, or Decode to turn entities back into characters.
- Paste your text.
- Optionally encode every non-ASCII character as a numeric entity.
- Copy the result.
Questions
- Which characters must be escaped in HTML?
- & and < always; > for safety; and " or ' inside attribute values. Escaping these five is enough to show user text safely in HTML.
- Does escaping protect against XSS?
- Escaping output for the right context is the core defence for HTML text and attributes. It is not enough inside script tags, event handler attributes or URLs, which need their own encoding.
- Do I need to encode accented letters?
- Not if your page is served as UTF-8, which nearly every modern page is. Encoding all non-ASCII is only useful for systems that can’t handle UTF-8.
Something not working, or a result looks wrong? Report a problem with this tool