HTML Entity Encoder

They stop the browser from mistaking data for markup. If a commenter writes a script tag and you print it raw, the browser runs it; print <script> instead and it displays harmlessly. Encoding user input this way is the classic defense against stored XSS.

Five of them: & becomes &amp;, < becomes &lt;, > becomes &gt;, the double quote becomes &quot;, and the apostrophe becomes &#39;. These are the html character codes that matter for safety; accented letters are left alone because modern UTF-8 pages don't need them escaped.

Yes, both flavors. Decimal references like &#169; and hex ones like &#xA9; are converted, along with the common named set including &amp;, &lt;, &gt;, &quot;, and &nbsp;. That makes html decode online useful for reading text copied out of feeds or scraped pages that arrive full of entity soup.

Only naming. The phrase html character entities usually means the named forms like &amp;, while a numeric reference points at the character's code position instead. Both spell out the same characters, and the Decode button handles either style.

Any time a value contains quotes or ampersands and comes from data you don't control. An unescaped double quote inside href or title ends the attribute early and lets the rest of the string inject markup. Running the value through html encode online first keeps the attribute sealed.

No. It's an entity tool, not an html parser online, and it won't reorganize markup the way a general html converter would. For indentation and structure, the HTML Beautifier is the right page; come back here when individual characters need escaping.

No, the pair lives on one page. Encode before you publish untrusted text, then paste anything suspicious back later and decode it to audit what was stored. Round-tripping a string is also a quick html entity decode test when output looks doubled, like seeing &amp;amp; on a live page.

Paste the sample and click Encode. The five risky characters, the ampersand, both angle brackets, and both quote marks, become entities, which is all the encoder does here. The browser then displays the code as text instead of trying to run it.

Yes, the two buttons cover both directions on one page. Encode untrusted text before you publish it, then paste stored strings back and decode them to see what they really contain, including named and numeric entities.

That is a good fit. Run comment text through Encode, and stray quotes, ampersands, and angle brackets can no longer break your markup or slip a script into the page. Escaping on output is the reliable habit.