HTML Entities

Escape special characters to HTML entities and decode back. Free, runs entirely in your browser — no signup, and nothing you paste in is uploaded.

Escaping is what stands between text and markup. Five characters carry structural meaning in HTML — `<`, `>`, `&`, `"` and `'` — and turning them into entities is how a string of user text becomes something a browser renders instead of executes. Almost every cross-site scripting bug is this step skipped somewhere.

The `&` is the one people forget, and it is the one that breaks round trips: escape the angle brackets but not the ampersand and `<` in the source turns into a literal `<` on the way back. Decoding is the same job in reverse, and useful when text has been escaped twice and arrives full of `&amp;`.