HTML Trình mã hóa/Trình giải mã
Mã hóa text to HTML entities or decode HTML entities back to text. Handles & < > " '.
Local processingWhat is HTML Trình mã hóa/Trình giải mã?
An HTML encoder (entity encoder) converts characters that have special meaning in HTML — & < > " ' — into their corresponding character entity references (& < > " '). This prevents raw text from being interpreted as markup, which is the primary defense against cross-site scripting (XSS). The decoder reverses the transformation, turning entities back into literal characters.
How It Works
The encoder scans the input and replaces each special character with its named entity: & → & (always first to avoid double-encoding), < → <, > → >, " → ", ' → '. The decoder matches named and numeric entities (&#nn; decimal or &#xhh; hex) and converts them back to characters using a lookup table. Numeric entities are decoded by parsing the code point. All processing is local and O(n).
Common Use Cases
- Safely displaying user input — encode before inserting untrusted text into HTML to prevent XSS
- Showing code samples in a page — encode < and > so they render as text, not tags
- Preparing XML content — escape special characters for safe embedding in XML documents
- Cleaning pasted content — decode entities from a rich-text editor back to plain characters
Technical Details
Encoded characters: & < > " ' (the five HTML-significant characters). Named entities: & < > " '. The encoder always replaces & first to avoid double-encoding existing entities. Numeric entities (&#nn;, &#xhh;) are decoded to their Unicode code points. The tool does not encode all non-ASCII characters — only the five markup-significant ones. Output is ASCII-safe for those five characters.
How to Use
Enter your input above. The result updates automatically. Use the copy button to copy the result.
Privacy
All processing happens in your browser. Your data is never uploaded to any server.
FAQ
Which HTML entities are handled?
& < > " and ' are encoded to their entity equivalents.
Is my text uploaded to a server?
No. All encoding and decoding happens locally in your browser. Your text never leaves your device, making this safe for sensitive content.
What is the difference between encoding and escaping?
In the HTML context they refer to the same operation: replacing special characters with entity references. Encoding is the general term; escaping emphasizes the security purpose — preventing raw text from being interpreted as markup, which is the primary defense against XSS attacks.