HTML Encoder & Decoder

It replaces the five characters that have special meaning in HTML — < > & " and ' — with entities (&lt; &gt; &amp; &quot; &#39;) so a browser displays them as text instead of interpreting them as tags or attribute delimiters. That is how you show a code sample like <div> on a page, and it is also the basic defence against cross-site scripting when printing user input.

Numeric entities (&#233; or &#xE9;) work everywhere, including XML and XHTML, which only know the five basic named entities. Named ones (&eacute;, &copy;, &mdash;) are easier to read. Modern pages served as UTF-8 rarely need either for accents and symbols — just type the character — but entities are still useful in ASCII-only files, templates and email HTML.

Only inside attribute values delimited by single quotes, but encoding it always (as &#39;) is the safe habit. Avoid &apos; in HTML 4 contexts — it was an XML entity that older Internet Explorer versions did not understand; &#39; works in every browser.

It does not render anything — the output box is plain text. If you decode &lt;b&gt;bold&lt;/b&gt; you get the characters <b>bold</b>; whether they become formatting depends on where you paste them next. Decoding is exactly the inverse of encoding.

No. Encoding uses a simple character map and decoding uses the browser’s own HTML parser on a detached textarea element. Nothing leaves your device.