Output will appear here...HTML Entity Encoder/Decoder converts characters that have special meaning in HTML into safe entity references, and turns entities from any source back into readable text. In HTML, < starts a tag and & starts an entity — so if user-generated content containing <script> lands in your markup unescaped, the browser executes it. Escaping those characters as <script> is the canonical defense against reflected and stored XSS, and this tool performs exactly that transformation using OWASP's recommended minimum set: & < > " and the single quote.
The tool supports three encoding strategies because different contexts need different output. Named mode uses a built-in map of over 100 memorable entities — © for ©, é for é, — for —, … for … — with an automatic numeric fallback (&#NNNN;) for any character without a common name, including emoji. Numeric mode encodes everything as decimal character references, which is what you want for XML or RSS feeds where only five named entities (& < > " ') are defined and would break the parser. Special-only mode escapes just the five XSS-critical characters, leaving accented text and typography readable in your source — the mode most template engines use by default.
The decoder is equally thorough: it handles named entities, decimal references like é, and hexadecimal references like é — all three forms you will find mixed together in scraped pages, CMS exports, and email HTML. Everything is implemented in pure TypeScript with no DOM tricks (no hidden textarea hack, no document.createElement), which means results are deterministic and the same logic runs identically in your browser, the desktop app, and on the server. Your content never leaves your machine — 100% client-side processing, safe for proprietary copy and user data alike.
Enter raw text you need to make HTML-safe (user input, marketing copy with © and ™, code snippets destined for a <pre> block), or paste entity-riddled HTML like <div class="card"> that you want to read as plain text.
Named for human-readable output (©, é), Numeric for XML/RSS-safe decimal references (©, é), or Special-only to escape just & < > " ' — the minimum required to prevent XSS while keeping the rest of the text readable.
Click Encode to convert characters to entities, or Decode to resolve named, decimal ({), and hex () references back to characters. The live character count shows how much the entity expansion grew your string.
Copy the result to your clipboard, or hit swap to feed the output back as input — useful for peeling apart double-encoded strings like &amp;lt; that went through two escaping layers.
Built-in map covering XSS characters, typography (— … smart quotes), currency (€ £), math symbols, Greek letters, and the full Latin-1 accented alphabet
Named for readability, numeric for XML/RSS compatibility, special-only for minimal XSS-safe escaping — pick per context instead of one-size-fits-all
Named (&), decimal (&), and hexadecimal (&) references are all recognized, even when mixed in the same document
No hidden-element browser hacks — deterministic logic that behaves identically in web, desktop, and server environments
Encode and decode URLs, query strings, and form data with encodeURIComponent, encodeURI, or form-urlencoded modes
Encode and decode text to/from Base64 format
Format, validate, and minify JSON data
Convert text between different cases (uppercase, lowercase, camelCase, snake_case, etc.)
0 comments
No comments yet. Be the first to share your thoughts!