HTML Encoder & Decoder
Escape text into HTML entities, or decode entities back to plain text.
Runs in your browser using DOM text nodes — nothing is uploaded
How to use it
- Paste your text or markup.
- Encode turns < > & " into entities. Decode reverses it.
Questions
When do I need this?
Whenever you want to display code on a page rather than run it. Escaping < and & is also the basic defence against cross-site scripting when untrusted text is placed into a page.
Is escaping enough to prevent XSS?
For text placed in normal page content, yes. Inside attributes, URLs, or script and style blocks the rules differ and escaping alone is not sufficient.