Loading…
Escape text to HTML entities or decode entities back, to reason about XSS and safe output encoding.
HTML entity encoding replaces characters that have structural meaning in HTML — <, >, &, ", ' — with named or numeric entities like < and &. This is the single most important defense against cross-site scripting (XSS) in HTML contexts: if user input is entity-encoded before it is written into a page, the browser renders it as text instead of parsing it as markup. This tool encodes text to entities and decodes entities back, so you can see exactly what a template will output.
How you'll use it. Paste raw text to get its entity-encoded form (what safe output should look like), or paste entity-laden text to see what it renders as. <script>alert(1)</script> encodes to <script>alert(1)</script> — inert on a page. Conversely, if you find <script> already in stored data, decoding shows the payload someone tried to inject. Pair this with the XSS payload reference to see which encodings actually neutralise each context.
Context matters. Entity encoding is correct for HTML body and attribute contexts, but it is not a universal fix. Data placed inside a <script> block needs JavaScript string encoding; data in a style attribute needs CSS encoding; data in a URL needs percent-encoding. Applying HTML entity encoding in a JavaScript context, or vice versa, can still leave an exploitable hole. Always encode for the context where the data lands.
Common mistake. Encoding once and then decoding somewhere in the pipeline, which reintroduces the raw characters before they reach the browser — a frequent cause of "we encode, but XSS still fires." Encode at the point of output, not early, and do not double-handle the value.
Defensive angle. Prefer a framework that auto-escapes by default (React, modern template engines) and treat any use of dangerouslySetInnerHTML, innerHTML, or "raw"/"safe" filters as a deliberate, reviewed exception. Combine output encoding with a strong Content-Security-Policy so that even a missed escape does not immediately become script execution — the security header analyzer grades whether your CSP is actually strict enough to help. Data bound for a URL context needs percent-encoding rather than HTML entities, so encode for where the value lands, not by habit.
Encode text to Base64 and Base64URL, and decode Base64 back to readable text with a hex view of the raw bytes — both directions, in your browser.
Base64, base64url, hex, percent-encoding, and HTML entities in one pass.
Convert hexadecimal to readable UTF-8 text and text to hex, tolerant of spaces and colons — both directions in your browser.
Percent-encode text for safe use in URLs and query strings, and decode percent-encoded values back to plain text — including a second pass that exposes double-encoding.
Encode and decode Base64 text and files.
Encode, decode, and parse URL components.