HTML Encode/Decode
HTML entity encode/decode for markup and text locally.
HTML Encode/Decode converts special characters to HTML entities and back for safe text insertion and debugging. Encode angle brackets, ampersands, and quotes before templating, or decode entities from exported markup—all locally in your browser.
How it works
Encode mode replaces &, <, >, ", and ' with standard named entities. Decode mode parses &name;, &#decimal;, and &#xhex; sequences using a built-in entity map and numeric code point conversion.
Benefits
- Fast entity encode and decode without server round-trips
- Supports common named and numeric HTML entities
- Examples for tags, attributes, and unicode text
- Copy, download, and optional on-device history
Use cases
- Escape user comments before inserting into HTML templates
- Decode entities from email or CMS exports
- Prepare snippets for documentation examples
- Compare encoded output with framework escapers
Best practices
- Encode user-controlled text at the output boundary for your context
- Use a dedicated sanitizer when rendering untrusted HTML documents
- Prefer UTF-8 pages so you encode only structural characters when possible
- Decode only trusted sources when inspecting sensitive markup
Common mistakes
- Double-encoding already escaped entities
- Assuming entity encoding alone prevents all XSS vectors
- Decoding untrusted HTML and injecting it with innerHTML
- Confusing HTML entities with URL percent-encoding
Privacy
HTML encoding and decoding happen locally in your browser. Your markup is not uploaded to ToolHub servers. Optional device history stores inputs on this device only if you enable it.
Frequently asked questions
- What characters does HTML encoding escape?
- Encode mode converts ampersand, less-than, greater-than, double quote, and apostrophe into named entities such as &, <, and "—the core set for text and attribute safety.
- Does HTML Encode/Decode upload my markup?
- No. Encoding and decoding run entirely in your browser with string transforms.
- Is this a substitute for a full HTML sanitizer?
- No. Entity encoding helps display literal text but does not remove scripts or unsafe URLs. Use a dedicated sanitizer such as DOMPurify when rendering untrusted HTML.
- Which named entities can be decoded?
- Decode mode supports common named entities (amp, lt, gt, quot, apos, nbsp, copy, reg, hellip, mdash, ndash) plus numeric &#...; and &#x...; forms.
- When should I encode versus decode?
- Encode before inserting user text into HTML templates. Decode when inspecting stored entities from CMS exports, emails, or legacy templates.
- How is this different from URL encoding?
- HTML entities represent special characters in markup (< for <). URL encoding uses percent escapes (%3C) for URI components. Use the right tool for the context.
- Will encoding prevent XSS by itself?
- Encoding user text is necessary in many contexts but not sufficient alone. Context matters—attributes, scripts, and URLs each need appropriate escaping or sanitization rules.
Related tools
URL Encode/Decode
developer
URL percent-encoding with component and URI modes locally.
- url
- encode
- decode
- percent-encoding
Base64 Encode/Decode
developer
Unicode-safe Base64 encode/decode for text and files locally.
- base64
- encode
- decode
- developer
Caesar Cipher
security
Adjustable-shift Caesar cipher, encode and decode.
- caesar
- cipher
- encode
- decode
ROT13 Cipher
security
Classic ROT13 letter-shift cipher, encode = decode.
- rot13
- cipher
- encode
- decode
JWT Decoder
security
Inspect JWT header and payload locally—no signature verify.
- jwt
- token
- decode
- security
SVG Viewer
image
Sanitize, preview, and clean SVG locally.
- svg
- viewer
- sanitize
- optimize