Encode & Decode • Prevent Script Injection • 100% Local
This shows what the escaped output looks like when rendered as HTML — any tags or scripts should appear as inert plain text, not run.
This tool converts the characters that have special meaning in HTML — &, <, >, ", ', and / — into their corresponding HTML entities (&, <, and so on), which the browser renders as literal text instead of interpreting as markup. This is the classic defense against Cross-Site Scripting (XSS): if user-supplied text is ever inserted into an HTML page without escaping it first, an attacker can submit something like <script>...</script> and have it execute in every visitor's browser.
One detail that's easy to get wrong when implementing this by hand: the ampersand (&) must be escaped first, before any other character — escaping < to < and only afterward escaping & would corrupt that entity into &lt;, which decodes back to the literal text "<" instead of "<". This tool handles that ordering correctly.
An important caveat: HTML entity escaping protects text placed inside HTML body content or inside a quoted HTML attribute. It is not sufficient on its own for text inserted into a <script> block, a URL, inline CSS, or an unquoted attribute — those contexts need their own specific encoding (JavaScript string escaping, URL encoding, etc., respectively). This is a general principle in web security known as contextual output encoding.
All processing happens locally in your browser.