HTML Encode / Decode
Escape or unescape HTML special characters (&, <, >, ", ’).
Convert text to HTML-safe entities (so &, <, > and quotes display literally instead of being parsed as markup) — or decode entities back to plain text. A handy developer utility.
Formula / method
Examples
<b>Hi</b>
©
Why some characters need escaping
A browser reads certain characters as markup instructions rather than literal text. The less-than sign opens a tag, the ampersand starts an entity, and quotes close attribute values. If you want those symbols to appear on the page as-is, you replace them with named entities: ampersand becomes &, less-than becomes <, greater-than becomes >, a double quote becomes ", and a single quote becomes '.
Encoding in this direction lets you display code samples, math expressions or user comments without the browser trying to render them as real elements.
Encode versus decode
The decode direction does the reverse, turning < and similar entities back into the plain characters they represent, which is handy when you copy text out of an HTML source or an API response that double-escaped it. Escaping is also a basic defence against cross-site scripting: neutralising the less-than sign stops injected markup from executing. It is not a complete security layer on its own, but for showing untrusted text it is essential. For encoding aimed at links rather than page content, use the URL Encoder instead.
Where it's used
- Safely displaying code snippets that contain < > and & on a web page
- Escaping user-supplied text to prevent HTML injection
- Showing example markup verbatim in documentation or a tutorial
- Encoding special characters when pasting text into a CMS or blog editor
- Escaping characters for HTML email or XML
Real-world examples
- '<script>' becomes '<script>', so a browser prints it as text instead of running it.
- 'Fish & Chips' encodes to 'Fish & Chips' — a bare ampersand is not valid in HTML.
- A double quote inside an attribute is written '"' so it does not close the tag early.
Did you know?
Only five characters strictly need escaping in HTML — <, >, & and, inside attribute values, the quote marks " and '. Characters like é or © can be written directly on a UTF-8 page.
FAQ
When do I need HTML encoding?
Whenever you show user text inside a web page: encoding prevents characters like < and & from being interpreted as HTML, which avoids broken layout and injection issues.