123024.com · HTML

HTML Entity Encode / Decode

HTML entities (<, >, &, ", and others) let pages safely display reserved characters. Editing CMS content, checking XSS escaping, or reading escaped template output often means switching between entities and raw text.

Why escape

If user input like <script> is inserted into HTML without escaping, the browser may treat it as a real tag. Correct entity encoding is basic display-layer protection (still combine with context-aware encoding and CSP).

This tool quickly encodes or decodes entities locally so you can check over-escaping or missing escapes. It does not replace your framework’s safe encoding APIs.

Tips

  • After decoding, confirm a rich-text editor will not escape again when you paste back.
  • Attribute values, HTML text nodes, and JavaScript strings have different encoding rules — do not mix them.