In HTML, characters like <, >, & and quotes have structural meaning — they open tags and delimit attributes. To display them as literal text, they must be converted to entities: <, >, &, ". Forgetting this is why code snippets vanish from blog posts and why unescaped user input opens the door to cross-site scripting (XSS) attacks.
This tool converts text to HTML entities and back. Use it to safely embed code examples in web pages, to debug already-escaped strings from templates and CMSs, or to inspect what a string full of ' sequences actually says.
How to Use This Tool
- Paste the text or HTML to convert.
- Click Encode to escape special characters into entities, or Decode to convert entities back to characters.
- Copy the output into your HTML, template, or documentation.
- Use Encode whenever you are inserting untrusted or code-like text into a page.
Frequently Asked Questions
Which characters must always be escaped in HTML?
At minimum: & (as &), < (as <) and > (as >). Inside attribute values you must also escape the quote character delimiting the attribute — usually double quotes (").
What is the difference between named and numeric entities?
Named entities like é are readable shortcuts that exist for common characters. Numeric entities like é or hex é work for any Unicode character. Browsers treat them identically.
How does escaping prevent XSS?
XSS happens when user input containing