Introducing the HTML Entity Encoder & Decoder

Inserting raw text into HTML is the classic way to break a layout — or open an XSS hole. The new HTML Entity Encoder escapes the characters that have special meaning in markup, and decodes entity-laden text back into readable characters, all in your browser.

What it does

• Encode: turn &, <, >, and quotes into safe entities, with the ampersand always handled first so output never double-encodes.
• Full mode: optionally escape every non-ASCII character to a numeric entity for ASCII-only transport.
• Decode: resolve named, decimal, and hexadecimal entities back to text in one pass.
• Reference table: the most common entities listed side by side.
• Private: everything runs client-side; nothing is uploaded.

Why it matters

Escaping is the simplest, most reliable defence against markup injection, and decoding is indispensable when you are debugging tangled, double-encoded strings. Having both in one place — with correct ampersand-first ordering — removes a whole class of subtle bugs.

Learn more

New to entities or unsure which characters to escape? Our HTML entities guide walks through named versus numeric entities, double-encoding, and the security angle — then try it live in the HTML Entity Encoder.