What does HTML Entity Encode / Decode actually do?

HTML entity encode turns , &, and quotes into entities so they are text, not markup. Decode reverses entities. Encoding is for HTML text context. It is not a complete XSS filter for attributes, URLs, or JavaScript strings.

When should I use HTML Entity Encode / Decode?

Use it to escape a string you will place in HTML text, or to read an escaped snippet.

When should I not use HTML Entity Encode / Decode?

Do not treat encode as a sanitizer for untrusted HTML you plan to inject.

What does HTML Entity Encode / Decode not do?

Context matters. An entity-encoded string can still be dangerous in a URL or an event handler. Does not parse a full document and escape only text nodes.

HTML Entity Encode / Decode

Escape or unescape HTML entities (& < > etc.). Free online — runs locally, no upload.

Input

Output

Search tools

HTML Entity Encode / Decode