HTML-entiteettikoodain / dekoodain

An HTML entity encoder and decoder for escaping special characters so they display as text instead of being interpreted as markup. It converts characters like < and & into entities such as &lt; and &amp;, and decodes them back again.

Encoding and decoding are UTF-8 safe and run entirely in your browser, so nothing you paste is uploaded.

Encoding always escapes the five characters that have special meaning in HTML: & < > " and '. That is what stops a stray < from being read as the start of a tag, or text from accidentally breaking out of an attribute.

An Encode all option additionally turns every non-ASCII character into a numeric entity, which is useful for legacy systems, some email pipelines, or anywhere you need to be sure the output is pure ASCII.

Decoding understands all three entity forms: named entities like &amp; and &copy;, decimal entities like &#233;, and hexadecimal entities like &#x20AC;. Sequences it does not recognize are left untouched rather than mangled.

Escaping the HTML specials is the core defense against HTML injection and cross-site scripting (XSS): any untrusted text should be encoded before it is placed into a page, so it renders as harmless characters instead of active markup.