ToolDeck

HTML encode and decode

Escape text for HTML, or decode named and numeric HTML entities.

Runs in your browser. Your input is not uploaded.

What it does

HTML encoding replaces the characters that have meaning in markup with entities, so text displays literally instead of becoming tags: < becomes &lt;, & becomes &amp;. It is the basic defence against injecting markup into a page.

Decoding handles named entities such as &nbsp; and &copy;, decimal &#169; and hex &#xA9;.

How to use it

  1. Paste the text or HTML.
  2. Choose Encode or Decode. When encoding, choose whether to encode quotes and non-ASCII characters.
  3. Copy the result.

Example

Input
<a href="x">Fish & Chips</a>
Output
&lt;a href=&quot;x&quot;&gt;Fish &amp; Chips&lt;/a&gt;

Things to watch for

  • Encoding is right for text inside elements and quoted attributes. It is not enough inside <script>, style or unquoted attributes.
  • Decoding untrusted input and then inserting it as HTML undoes the protection.

Questions

Which characters must be encoded?
& and < always. > for safety. " and ' inside attribute values.
Should I encode non-ASCII characters?
Not if the page is served as UTF-8, which it should be. Encoding them as numeric entities is only useful for systems that mangle UTF-8.
What happens to unknown entities?
They are left as they are and listed under the result, so a typo like &nbps; is easy to spot.
Is this the same as URL encoding?
No. URL encoding uses % sequences for URLs. HTML encoding uses &...; entities for markup.