webutilkit

HTML Entity Encoder / Decoder

Escape text for safe embedding in HTML, or decode entities back to plain text. Runs locally in your browser.

Escaped HTML
How it works


Encoding replaces the five characters that have special meaning in HTML —
& < > " ' — with their named entities, so text can be embedded in a page
without being interpreted as markup. Decoding parses entities back to plain
text using the browser’s own HTML parser, so it handles both named entities
like &amp; and numeric ones like &#38;.


Why this matters


Printing user-supplied text directly into an HTML page is a classic source
of cross-site scripting bugs: a value like <script> becomes live markup
instead of visible text. Escaping the unsafe characters first is what turns
it back into inert text.


What this does not do


This is not a full HTML sanitizer. It escapes characters for safe display
as text content — it does not parse or clean up untrusted HTML markup, strip
dangerous attributes, or validate document structure.
Frequently asked questions
Which characters get encoded?
The five characters that are unsafe to place directly in HTML markup: & < > " and '. These are replaced with &amp;, &lt;, &gt;, &quot; and &#39;.
Does decoding understand numeric entities too?
Yes. Decoding uses the browser’s own HTML parser, so both named entities like &amp; and numeric ones like &#38; or &#x26; are handled correctly.