How to use the HTML encoder

  1. Choose Encode to escape text so it displays literally in a web page, or Decode to turn entities back into normal characters.
  2. Paste your text. The result updates as you type.
  3. When encoding, tick Also encode non-ASCII characters if the destination cannot handle UTF-8, such as some older email templates or systems that save files in another encoding. Characters like é become numeric references like é.

Decoding understands all named entities defined by HTML (such as  , —, and é), decimal references like —, and hexadecimal references like 😀.

Why HTML needs escaping

Browsers treat some characters as markup. If you want them to appear as text, you have to escape them:

  • < and > start and end tags.
  • & starts an entity.
  • " and ' end attribute values.

For example, to show a code sample on a page, <p class="note"> must be written as &lt;p class=&quot;note&quot;&gt;. Without escaping, the browser would create a real paragraph instead of showing the code.

Escaping and security

Escaping is the main defense against cross-site scripting (XSS) when you insert user-provided text into HTML. If a comment contains <script>, escaping turns it into harmless text.

However, escaping is only correct for the place where the text goes:

  • Inside HTML content or a quoted attribute, escaping the five characters above is sufficient.
  • Inside a <script> block, a URL, or CSS, HTML escaping is not enough. Each of those needs its own encoding rules.
  • In templates, use your framework's automatic escaping (React, Vue, Django, Twig, Blade, and others do this by default) instead of escaping by hand.

Use this tool to prepare snippets, check what an escaped string contains, or debug double-escaped output. It is not a replacement for escaping in your application code.

Common problems

  • Double escaping. If a page shows &amp;amp; or &amp;lt;, text was escaped twice. Decode once to see the original.
  • Missing semicolons. &copy without a semicolon works in some cases because of browser error recovery, but &copy; is always correct.
  • Non-breaking spaces. Text copied from Word or web pages often contains &nbsp; characters that look like spaces but do not wrap. Decoding shows them as a special space character you can replace.

Frequently asked questions

What is the difference between &#39; and &apos;?

Both represent an apostrophe. &apos; is defined in HTML5 and XML, but was not part of HTML 4, so &#39; is the safer choice for older email clients.

Is decoding safe if my text contains script tags?

Yes. The decoder reads entities in a way that never runs scripts or loads images. The result is shown as plain text.