HTML Entity Encoder / Decoder

Escape text for safe HTML, or decode entities back to readable characters.

Text or HTML

Also escape accents, emoji and other non-ASCII characters

Escaping &, <, > and quotes is what stops user-supplied text being read as markup — the root cause of most cross-site scripting bugs. Decoding is deliberately limited to numeric references and common named entities.