Developer & Web Tools
HTML Entity Encoder & Decoder
Escape text for safe display in HTML, or convert entities back to characters.
Privacy
Everything on this page runs inside your browser. Nothing you paste, type or upload is transmitted, logged or stored.
Tips
- Escaping user input before putting it in a page is the single most effective defence against cross-site scripting.
- Escape & first when doing it by hand, or you will double-escape the other entities.
- Inside an HTML attribute you must escape quotes as well as angle brackets.
Frequently asked questions
Is escaping enough to stop XSS?
For text placed between tags, largely yes. Content injected into a script block, a style block, an event handler or a URL attribute needs context-specific escaping — HTML escaping alone will not protect those positions.