HTML Encoder

HTML encoding replaces characters that have a meaning in HTML with entities (character references), so they show as text instead of being read as markup. For example, < becomes < and & becomes &.

It is what makes text safe to put between tags and inside quoted attribute values, one of the main defenses against XSS (Cross-Site Scripting).

• Paste text or HTML; the output updates as you type. Auto decodes input that contains entities and encodes everything else. Encode and Decode fix the direction.
• Encode Quotes also converts " and ', which attribute values need.
• All Non-ASCII writes every character beyond ASCII as a numeric entity, in Decimal or Hex.
• The options only show when encoding. Clear resets them.
• The dice loads a random example to encode or decode.

• Encoding protects text between tags and in quoted attribute values. It does not protect unquoted attributes, <script> or <style> content, or URLs such as javascript: links; those need their own escaping or checks.
• Decoding follows the HTML standard, as a browser reads a page: every named entity, decimal and hex numbers, and the old forms without a semicolon such as &copy.
• Decoded tags stay text: nothing in the input is run or loaded.