TULKIT

HTML Encoder & Decoder - Encode HTML Entities Online

Encode and decode HTML special characters to prevent XSS attacks, display code snippets, and safely render user-generated content. Convert characters like <, >, &, and quotes to their HTML entity equivalents.

Why Use HTML Encoding?

  • Security: Prevent XSS and code injection attacks
  • Display Code: Show HTML code snippets as text
  • Safe Content: Sanitize user-generated content
  • Special Characters: Display symbols like ©, ®, €

Common Use Cases

🔒 Security

Prevent XSS attacks in web applications.

📖 Documentation

Display HTML code examples in tutorials.

💬 User Content

Sanitize comments, reviews, and forum posts.

📧 Email

Encode HTML content for email templates.

How to Use This Tool

  1. Choose Mode: Select "Encode" to convert HTML to entities or "Decode" to convert back.
  2. Enter Content: Paste your HTML or encoded text.
  3. Get Result: The conversion happens instantly - copy the result.

💡 Tip: Always encode user input before displaying it on web pages to prevent XSS attacks.

HTML Encoder / Decoder

Common HTML Entities

Basic Characters

  • < → &lt; or &#60;
  • > → &gt; or &#62;
  • & → &amp; or &#38;
  • " → &quot; or &#34;
  • ' → &#39; or &apos;

Special Symbols

  • © → &copy; or &#169;
  • ® → &reg; or &#174;
  • ™ → &trade; or &#8482;
  • € → &euro; or &#8364;
  • £ → &pound; or &#163;

Math & Arrows

  • × → &times; or &#215;
  • ÷ → &divide; or &#247;
  • ± → &plusmn; or &#177;
  • → → &rarr; or &#8594;
  • ← → &larr; or &#8592;

Named vs Numeric Entities

  • Named Entities: Human-readable like &copy; for ©
  • Numeric Entities: Unicode code points like &#169; for ©
  • Hexadecimal: Hex code points like &#xA9; for ©
  • Named entities are easier to read but limited in number
  • Numeric entities work for any Unicode character

XSS Prevention Example

Dangerous (Unencoded):

<script>alert('XSS')</script>

⚠️ This would execute as JavaScript!

Safe (Encoded):

&lt;script&gt;alert('XSS')&lt;/script&gt;

✓ This displays as text

Best Practices

  • Always encode user-generated content before display
  • Encode both on input (storage) and output (display)
  • Use server-side encoding libraries for production code
  • Encode the minimum necessary - don't double-encode
  • Consider context - HTML encoding differs from URL encoding

Related Tools