HTML Encoder / Decoder

Five characters carry meaning in HTML: the ampersand, the two angle brackets, and both quote marks. The ampersand must be escaped first, otherwise escaping the others would corrupt the entities you just produced.

Whenever a character would otherwise be read as markup. Writing < or & literally inside page content risks the browser interpreting it as the start of a tag or an entity, so they become &lt; and &amp;. Encoding is also how you place characters that are awkward to type directly into a file.

They are three spellings of the same character. Named entities such as &amp; read most clearly but only exist for a defined set. Decimal (&#38;) and hex (&#x26;) reference the code point directly and therefore work for every character. Decode accepts all three regardless of which you chose for encoding.

Escaping is the right primitive, but doing it once by hand is not a security strategy. Real protection comes from escaping at the point of output, automatically, for every untrusted value — which is what a template engine does for you. Use this tool for inspecting and converting content, not as your defence.

Yes. Characters outside the Basic Multilingual Plane, including most emoji, are stored as surrogate pairs in JavaScript strings; the encoder combines them back into a single code point so you get one entity rather than two broken halves.

Use the Swap button. It moves the current output into the input and flips the direction, which is handy for confirming that a round trip returns exactly what you started with.