Stays in your browser
HTML Encode / Decode Online
Free HTML encoder and decoder. Escape < > & and quotes to entities, or unescape them back.
Escaping output without breaking it
HTML encoding exists to stop input from being interpreted as markup. If a value reaches the page without escaping, an angle bracket closes an element and a quote ends an attribute, which is how most cross-site scripting bugs begin.
Five characters matter: ampersand, less-than, greater-than, and both quote styles. Encoding more than that is harmless for correctness and harder to read, and double encoding is the common failure: an entity escaped twice renders as the literal text of the entity, because the second pass escaped a string that was already safe.
Encode for the context you are writing into. Text between tags, an attribute value and a JavaScript string all need different treatment, and HTML entities are not sufficient inside a script block, where the parser has already left HTML behind. Encode once, at the point of output, rather than storing escaped values.
FAQ
- Why encode HTML?
- To display raw tags or special characters safely in a page.
- Is it the same as URL encode?
- No. HTML entities are for document content; URL encoding is for addresses.
- Is content uploaded?
- No. Everything runs locally.
- What is the difference between HTML encoding and URL encoding?
- They escape for different parsers. HTML encoding replaces characters that would end a tag or an attribute, while URL encoding replaces characters that are not allowed in a URL. Applying one where the other belongs produces text that looks escaped and is still wrong in its destination.
- Why does my page show the entity text instead of the character?
- The value was encoded twice. The first pass turned an ampersand into its entity, and the second pass escaped the ampersand of that entity, so the browser renders the entity literally. Encode exactly once, at output, and store the raw value.
- Do quotes need encoding in plain text content?
- Not between tags, where a quote is just a character. They must be encoded inside an attribute value, because the parser does not care whether the quote matches the one that opened the attribute. Encoding both quote styles everywhere avoids having to remember which context you are in.