HTML Entity Encoder & Decoder
Escape text so it is safe to place in HTML, or decode entities like & and © back into readable characters.
How it works
Five characters have special meaning in HTML and must be escaped when they appear as text: & becomes &, < becomes <, > becomes >, and the quotes " and ' become " and '. Escaping user-supplied text this way is the first line of defence against cross-site scripting (XSS).
"Encode all non-ASCII" also converts characters such as é or © to numeric entities (é), which is useful for legacy systems that do not handle UTF-8.
Frequently asked questions
Why do I need to escape ampersands in HTML?
An unescaped & can be read as the start of an entity, so text like ©=1 in a URL may be turned into a copyright sign. Writing & is always safe.
Does escaping prevent XSS?
It prevents it for text placed between tags or in quoted attributes. Use it on every user-supplied value, and use context-appropriate escaping for JavaScript, CSS and URLs.
What is the difference between named and numeric entities?
Named entities (©) are readable; numeric ones (©) work for any character and do not depend on a name table.