HTML Entity Encoder & Decoder — Escape HTML Safely

← Circuit CoveThe Creative Island · Island 08

Make HTML safe to display — turn <script> into harmless text, or decode entities back to characters.

Input

Output

How to use this tool

1. Choose Encode (escape for safe display) or Decode (entities → characters).
2. Paste your HTML or text.
3. Press Convert.

Example

Encode <b>bold</b> for display → <b>bold</b> — the browser then shows the tags as text instead of rendering them. Decode reverses it, including named entities like &copy; → ©.

The formula

escape: & < > " ' → & < > " '  |  unescape: entities rendered via a detached DOM element

What the result means

Encoding is the first line of defense against XSS: angle brackets become harmless text, so user input can never become executable markup. The five characters escaped here are the exact set recommended by OWASP for HTML context — more is unnecessary, less is unsafe.

Frequently asked questions

Is this the same as URL encoding?

No — URL encoding (%20) is for links; HTML entities (&lt;) are for page content. Different worlds, different escapes. The URL tool handles the other one.

Why only five characters when encoding?

Because those five are the ones that change HTML structure (& starts entities, < > make tags, quotes break attributes). Escaping more just bloats the text.

Does decoding execute any code?

Never. The decoder renders entities into a detached textarea and reads back plain text — no script runs at any point.

Is my text uploaded?

No — everything happens locally in your browser.

More tools from Circuit Cove

Base64 Encoder/DecoderEncode or decode textURL Encoder/DecoderEncode URLs safelyJSON FormatterPretty print JSONMarkdown PreviewerOn Paper Port

Explore the island world

• Circuit Cove — the island where this tool lives.
• The Main Island — drive the boat, explore the whole world.
• The 90s Kids Island — where most of us started.

Privacy & data: this tool runs entirely in your browser — nothing you type is uploaded, saved or sent anywhere. · Disclaimer: all processing happens locally in your browser — never paste production secrets or private data into any online tool, including this one. · Privacy Policy · Disclaimer