Turn “<”, “>”, “&” and quotes into their entities, which is what you must do to show code inside a page without the browser swallowing it as markup.
Going the other way, the decoding is done by the browser’s own parser, so it understands every named entity there is rather than a short list.
How to use it
- Choose the direction.
- Paste the text or the code.
- Copy the result.
Frequently asked questions
- Which characters are escaped by default?
- The five that mean something in markup — &, <, >, " and ' — plus the non-breaking space. With the box ticked, everything above code point 127 as well.
- Do accents need escaping?
- Not if the page declares UTF-8, which it always should. The option is there for older systems and for HTML email, which still struggles with encoding.
- Is this enough to prevent injection?
- Escaping for HTML content is one piece, but inside an attribute, a <script> or a URL the rules differ. Do not treat this tool as a security control.
Related tools
Minify CSSCSSO: it restructures and merges rules, not just strips spaces.
Minify JavaScriptTerser in the browser, with optional name mangling.
Count words and charactersA live count, reading time and the limits each platform imposes.
Change letter caseUPPERCASE, lowercase, Title Case, camelCase, snake_case and more.
Sort and clean up linesSort, drop duplicates and blanks, number or reverse a list.