HTML Entity Encoder & Decoder
Escape or unescape HTML special characters. Convert &, <, >, quotes and named entities to safe code for safe HTML output.
Why escaping matters
If you insert user input into HTML without escaping it, a user can inject <script> tags and run JavaScript in your page. This is cross-site scripting (XSS), and it is one of the most common web vulnerabilities.
Escaping converts the dangerous characters into safe text entities:
| Character | Entity | Why |
|---|---|---|
& | & | Starts an entity reference |
< | < | Starts a tag |
> | > | Ends a tag |
" | " | Delimits an attribute value |
' | ' | Delimits an attribute value |
Which characters to escape
For HTML text content, escaping <, > and & is enough. For HTML attributes, you must also escape the quote character used to delimit the value. Escaping everything except alphanumerics is the safe default.
Escaping is not encoding
These are different operations:
- HTML escaping makes text safe to put in an HTML document
- URL encoding makes text safe to put in a URL query string
- JSON encoding makes text safe to put in a JSON string
Using the wrong one produces broken output rather than a security hole — but using none produces a security hole.
The framework rule
Most modern frameworks escape by default. React, Vue, Angular and Svelte all escape interpolated values, and warn you when you explicitly opt out with dangerouslySetInnerHTML or v-html. Prefer the default path.
Related
Building structured payloads? The JSON formatter validates and beautifies JSON before you ship it.
Frequently asked questions
What is HTML escaping for?
It makes text safe to insert into an HTML document. Without it, user input containing a <script> tag can execute JavaScript in your page — this is cross-site scripting.
Which characters need escaping?
For HTML text content, &, < and >. For attribute values you must also escape the quote character you use to delimit the value. Escaping everything except alphanumerics is the safe default.
Is escaping the same as encoding?
No. HTML escaping makes text safe for an HTML document, URL encoding makes it safe for a query string, and JSON encoding makes it safe for a JSON string.
Do modern frameworks escape automatically?
Yes. React, Vue, Angular and Svelte all escape interpolated values and warn when you opt out explicitly with dangerouslySetInnerHTML or v-html.
Can it decode named entities?
Yes, it decodes a set of common named entities such as &, <, , © and €, along with numeric and hex references.