What HTML encoding does
HTML treats a handful of characters as markup: < and > open and close tags, & starts an entity, and quotes delimit attributes. When you need those characters to appear as literal text, you replace them with entities such as < and &. This tool encodes text for safe insertion into HTML and decodes entities back into readable characters.
Encoding is not sanitising
Escaping the five characters above stops text from being interpreted as markup, which prevents a whole class of cross-site scripting bugs. It is not, on its own, a complete defence: attribute contexts, URLs and JavaScript contexts each have their own rules. Treat this as one correct layer, not a security guarantee.
Frequently asked questions
Which characters need to be encoded in HTML?
The critical five are & < > " and '. The ampersand must be encoded first, otherwise you double-encode the entities you just created. Encoding < and > is what stops text from being parsed as a tag.
What is the difference between named and numeric entities?
A named entity such as & is easier to read; a numeric one such as & or & works for any Unicode character and never depends on the browser knowing the name. Both decode to the same character.
Should I encode or decode?
Encode when you are about to insert untrusted text into an HTML document. Decode when you are reading HTML source and want to see the actual characters, for example when cleaning up text copied from a web page.
Does encoding prevent XSS?
Correctly escaping for the context you are writing into prevents the most common injection bugs, but XSS depends on where the value lands. Escape for the exact context (HTML text, attribute, URL, JavaScript) and never rely on a single blanket transform.