Which characters need HTML encoding?

The five with structural meaning: , &, double quote and single quote. The ampersand is the important one — miss it and any entity in the text will be decoded a second time, turning escaped markup back into real markup.

Does HTML encoding prevent XSS?

It is a necessary part of the defence but not sufficient on its own. Escaping is context-dependent — HTML text, attribute values, URLs and JavaScript strings each need different treatment. Use a framework that escapes by context for user input.

What is the difference between < and <?

Nothing in effect — both produce a less-than sign. The first is a named entity and the second a numeric reference. Named entities are more readable; numeric ones work for any character and are useful where the name is obscure.

Why does my text show & instead of &?

It has been encoded twice. An ampersand became &, and encoding that again turned the ampersand of the entity itself into &amp;. Decode once and check whether the result is what you meant before encoding.

Is my content uploaded?

No. Encoding and decoding run entirely in your browser, so page source or user data you are inspecting stays on your machine.

HTML Encode / Decode

Convert characters to HTML entities and back, to display markup safely as text.

DeveloperRuns in your browserFree, no signup

About the HTML Encode / Decode

HTML entity encoding converts characters that would otherwise be interpreted as markup into their entity form — < becomes <, & becomes &. It is what allows a page to display a piece of HTML as text rather than rendering it, and it is the mechanism that prevents user input from becoming executable markup.

The five characters that must be escaped in HTML are <, >, &, " and '. The ampersand is the one people forget, and it matters most: without escaping it, a string containing < would be decoded twice and turn back into a real angle bracket.

Encoding is context-dependent and this is not a substitute for it. Escaping for HTML text is different from escaping for an attribute value, a URL, or a JavaScript string, and applying the wrong one leaves a hole. Use a templating engine that escapes by context for anything user-supplied; this tool is for inspecting and converting content by hand.

How it works

Paste text or markup you want to display literally on a page.
Choose minimal escaping for the five characters that matter, or full escaping for every non-ASCII character.
Copy the result. Decoding goes the other way, resolving named and numeric entities.

Frequently asked questions

Which characters need HTML encoding?: The five with structural meaning: <, >, &, double quote and single quote. The ampersand is the important one — miss it and any entity in the text will be decoded a second time, turning escaped markup back into real markup.
Does HTML encoding prevent XSS?: It is a necessary part of the defence but not sufficient on its own. Escaping is context-dependent — HTML text, attribute values, URLs and JavaScript strings each need different treatment. Use a framework that escapes by context for user input.
What is the difference between &lt; and &#60;?: Nothing in effect — both produce a less-than sign. The first is a named entity and the second a numeric reference. Named entities are more readable; numeric ones work for any character and are useful where the name is obscure.
Why does my text show &amp; instead of &?: It has been encoded twice. An ampersand became &amp;, and encoding that again turned the ampersand of the entity itself into &amp;amp;. Decode once and check whether the result is what you meant before encoding.
Is my content uploaded?: No. Encoding and decoding run entirely in your browser, so page source or user data you are inspecting stays on your machine.

Privacy

Everything happens locally. Your files are read by your own browser, processed on your device, and never uploaded — closing the tab is all it takes to erase them.

Related Developer tools

JSON Formatter

Format, validate and minify JSON with clear error positions.

Base64 Encode / Decode

Convert text and files to Base64 and back, with URL-safe output.

URL Encode / Decode

Percent-encode and decode URLs, query strings and path segments.

HTML Formatter

Beautify or minify HTML with consistent indentation.