HTML Entity Encoder / Decoder

Safely escape or unescape HTML tags to prevent code execution and parsing errors.

Web Security 101

🛡️ Why Escape HTML Entities?

Learn why converting characters like < and > is critical for preventing Cross-Site Scripting (XSS).

When writing web applications, you often need to display code snippets or user-generated content on a page. The problem is that web browsers interpret characters like < and > as the beginning and end of executable HTML tags or scripts.

The Danger of Raw HTML (XSS)

If a user submits a comment on your blog that looks like this: <script>alert('Hacked!');</script>, and you output that directly into your DOM without escaping it, the browser will literally execute their JavaScript code. This is known as Cross-Site Scripting (XSS).

How Encoding Solves It

HTML Entities are safe representations of reserved characters. By encoding (escaping) the input, dangerous characters are replaced with text strings that the browser displays visually, but refuses to execute.

  • < becomes &lt;
  • > becomes &gt;
  • " becomes &quot;
  • ' becomes &#39;
  • & becomes &amp;

Decoding (Unescaping)

Sometimes you need to do the reverse. If you've scraped data from a website or pulled it from an old database and it is full of &quot; and &amp;, the Decode function will turn it back into raw, usable code.