How to encode or decode HTML
- Pick Encode or Decode at the top.
- Paste your text or HTML into the box.
- Tick the option for characters beyond basic English only if an old system needs it.
- Read the result that appears right away.
- Copy the result or download it.
What this HTML encoder decoder gives you
- Escapes for the five characters that matter most.
- Full decode support for every named entity the browser knows.
- Support for decimal and hex number entities.
- An option to encode accents and symbols for old systems.
- One box for both directions with a single switch.
- Live results in your browser with nothing uploaded.
What does escaping prevent?
HTML cannot tell if <script> in some text is markup or words to display. It assumes markup. That assumption causes cross site scripting. A user types a script tag into a form. The site drops it into a page. The browser sees a real script tag and runs it.
An escape step removes the doubt. Swap the angle brackets for < and >. The browser then shows the characters and does not run them. This one change is the base of output safety on the web.
The five characters an HTML encoder decoder must handle
| Character | Entity | Why it matters |
|---|---|---|
| & | & | Must go first or it escapes the others again |
| < | < | Opens a tag |
| > | > | Closes a tag |
| " | " | Ends a double quoted attribute |
| ' | ' | Ends a single quoted attribute |
Both quote marks matter. Attribute values may use either kind. Escape only one and an attacker can sneak in through the other.
Where you need encoding
Code samples on a web page are the everyday case. Without escaping your example markup renders on the page. It never appears as code.
The same need comes up in other places. You may drop user text into a template. You may store markup in a database field for later display. You may write tutorials about HTML itself. Each case needs escaped text.
Where you need decoding
The decode step reverses the process. You may read text that someone escaped along the way. You may clean content pulled out of a CMS. You may check what a payload holds when it arrives full of entities.
See &amp; in your text? Someone escaped it more than once. Each pass escaped the ampersand from the pass before. Decode again until the text stops changing.
An escape is not a sanitizer
The two ideas sound alike but do different jobs. An escape turns markup into visible text. That suits code you want to display. A sanitizer strips dangerous markup and keeps safe formatting. That suits rich text that users submit.
Neither replaces the other. Escape rich text and users see their own tags as plain text. A rich text editor needs a proper sanitizer library instead.
Characters beyond basic English
The option to encode accents and symbols serves old systems that mishandle UTF-8. You rarely need it today. It also makes the output much longer. Each accented letter becomes a number entity of six or seven characters.
Common HTML encoder decoder problems
My page shows & instead of &
Your system escaped the text twice. Decode it once and save the result. Then find the extra escape step in your code.
My code sample still renders as HTML
You pasted it raw. Encode it first and paste the result.
A quick HTML encoder decoder example
Pick Encode and paste <b>Tom & Jerry</b>. The tool shows <b>Tom & Jerry</b>. Paste that into a page and readers see the tags as text. Now switch to Decode and paste the result back. You get the original line again.
Tips for safe output
- Escape user text at the moment you place it in a page.
- Use the escape tools in your framework for live sites.
- Never escape the same text twice.
- Test forms with a harmless script tag before launch.
Who uses an HTML encoder decoder?
Developers display code snippets. Bloggers write tutorials. Security testers check how pages handle input. CMS editors clean imported content.
Your text stays private
The tool runs in your browser and uploads nothing. Need to tidy the markup itself? Use the HTML formatter. Do you write in Markdown? The Markdown to HTML converter escapes raw HTML for you. Want to escape a link instead? Try the URL encoder.