data_object HTML Entity Encoder / Decoder star

How It Works

HTML reserves a handful of characters for its own syntax: < and > mark tags, and & starts an entity reference. If those characters appear literally inside content that gets inserted into a page — a comment, a username, a search query echoed back — the browser tries to parse them as markup instead of displaying them as text. Encoding converts them into their entity form (<, >, &) so they render as the literal characters instead of being interpreted. Decoding reverses this, turning entities like & or ’ back into the actual characters they represent.

This is not a cosmetic detail — it is a security control. If a comment box takes user input and inserts it into the page HTML without encoding it first, a visitor can type <script>...</script> and have that script actually execute in every other visitor's browser: this class of vulnerability is called Cross-Site Scripting (XSS), and encoding untrusted output before it touches HTML is the standard defense against it. For example, encoding the text 5 < 10 & 10 > 5 produces 5 < 10 & 10 > 5, which displays correctly and cannot be mistaken for markup.

What You Should Know

• Named vs. numeric entities represent the same character differently. ' (named) and ' (numeric) both mean a single quote, but named entities depend on the parser recognizing that specific name — numeric entities (decimal or &#x hex) are universally supported and safer for machine-generated output.
• Encoding is not the only defense. It protects text content; attributes, URLs and inline JavaScript contexts need their own escaping rules, since a value inside href="javascript:..." or inside a <script> block is parsed under different rules than plain body text.
• Conversion is local. This tool uses your browser's own DOM parser — nothing is uploaded or logged.
• Not every server-side templating language auto-escapes by default. Some (like older PHP output or raw string concatenation) require you to call an escaping function explicitly — forgetting it is one of the most common sources of real-world XSS bugs.
• Some entities look almost identical visually. A straight apostrophe (') and a typographic right single quote (’) render nearly the same on screen but are different byte sequences — a distinction that matters in code samples or URLs.

A concrete before/after: a comment field containing Nice post! 5 < 10, right? needs no special handling as plain text, but the moment it's inserted into an HTML template unescaped, a malicious visitor could instead submit <img src=x onerror=alert(1)> — encoding turns that into inert, visible text instead of an executing image-error handler.