Which characters must always be escaped?

Five: '&', ' ', '"' and "'". The ampersand must be escaped first, otherwise you double-escape the entities you are creating — a classic source of '&' in production.

Does escaping HTML prevent cross-site scripting?

Correct context-appropriate escaping is the core defence, but context matters enormously — escaping for HTML text is not sufficient inside an attribute, a URL or a script block. Use your framework's built-in escaping rather than doing it by hand in production code.

Why does my text show '&' instead of '&'?

It has been escaped twice. Decode it once with this tool to recover the correct text, then fix whichever step in your pipeline is escaping content that was already escaped.

Developer ToolsWorks offline

HTML Entity Encoder & Decoder

Convert characters that would otherwise be interpreted as markup into HTML entities, and decode entities back to plain characters. Essential when displaying user content or code samples.

Getting started

How to use the HTML Entity Encoder & Decoder

1
Paste the text or markup you want to escape or decode.
2
Switch between encode and decode modes.
3
Choose whether to escape only the essential characters or all non-ASCII characters too.
4
Copy the result into your template, article or code sample.

Why it helps

What makes this tool worth using

Escapes the five characters that actually matter for safety, rather than mangling everything unnecessarily.
Decoding is useful when content arrives double-escaped from a poorly configured system.
Extended mode escapes non-ASCII characters for legacy systems with encoding problems.
Runs locally so unpublished content stays private.

In practice

Common ways people use it

Displaying a code sample inside an HTML page without the browser rendering it.
Escaping user-submitted content before inserting it into a template.
Fixing text that shows literal '&' sequences because it was escaped twice.
Preparing content for a system that cannot handle non-ASCII characters directly.