HTML Entity Encoder and Decoder
Escape &, <, >, quotes and optionally every non-ASCII character as HTML entities, or decode named and numeric entities back to text.
Free · No sign-up · Your inputs stay in your browser
Input
Encode or decode HTML entities
Output
Result
97 characters
Escaping the five special characters is all that safe output in a UTF-8 page needs; it is what Laravel's {{ }} and PHP's htmlspecialchars() do. Encoding every non-ASCII character is only for documents that cannot declare UTF-8.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Five characters are enough
A UTF-8 page can carry any character directly, so escaping for HTML only has to stop text from being read as markup: &, <, >, and the two quotes inside attribute values. That is what PHP's htmlspecialchars() does, with ENT_QUOTES on by default since PHP 8.1, and what Blade's {{ }} calls.
Escaping is per context
HTML escaping protects HTML text and quoted attributes. It does not make a value safe inside a script block, an unquoted attribute, a URL or CSS, which each need their own encoding. The OWASP XSS prevention cheat sheet lists the rules per context.
