HTML Entity Encoder & Decoder
Escape and unescape HTML entities instantly.
Encoded
<script>alert("xss")</script>
Decoded
<script>alert("xss")</script>Join the Veojson dispatch
Want the front-end security checklist we use for escaping and templating? Join the dispatch.
One email, no spam, unsubscribe any time.
About this tool
Encoding converts characters with meaning in HTML — &, <, >, quotes — into named entities so browsers render them as text rather than markup. It is the baseline defence against injected script in server-rendered pages.
When to escape
Escape any untrusted value that lands inside HTML text or an attribute. Modern frameworks do this by default; raw templating and dangerouslySetInnerHTML do not.
Named vs numeric entities
Named entities such as & are readable. Numeric entities such as & work everywhere including older parsers and XML.
How to use HTML Entity Encoder & Decoder
- 1
Open HTML Entity Encoder & Decoder
Everything runs on this page — there is nothing to install and no account required to use the free features.
- 2
Add your input
Paste or enter your values in the panel above. The tool updates as you type, so you can iterate quickly.
- 3
Review the output
Check the result, copy it with one click, and adjust the options until it matches what your system expects.
- 4
Take it further
Use the developer & api tips below to make the result production-ready, then unlock the gated extras via the form above.
Best practices
- Work from a real payload, not a hand-typed sample — encoding bugs hide in whitespace and Unicode.
- Keep the transformation reproducible: script it in CI once you have confirmed the output here.
- Never paste live credentials, customer records or production tokens into any web tool you have not audited.
- Version the inputs and outputs you rely on so a teammate can reproduce the same result later.
Why HTML Entity Encoder & Decoder matters
Small integration details — an encoding, a claim, a header — are where most API bugs actually live, and they are expensive to find in production logs.
Getting them right in seconds keeps debugging sessions short and prevents malformed data from reaching downstream systems.
Related free & paid tools
| Tool name | Type | Key features | Link |
|---|---|---|---|
| DOMPurify | Free | Sanitises untrusted HTML before you render it | Visit |
| he (npm) | Free | Spec-compliant HTML entity encoder/decoder | Visit |
| OWASP Java Encoder | Free | Context-aware output encoding for server code | Visit |
Links marked Offer may be partner links. They cost you nothing extra and never affect which tools we recommend.