Encode and Decode HTML Entities

Two buttons pick the direction: Encode escapes the four characters, Decode resolves entities through the browser's own parser. That matters because a string like Fish & Chips contains & but is not encoded — guessing from the input would decode it into data loss on markup like a & <b>.

Escaping the four HTML-significant characters is necessary but not sufficient everywhere. Unquoted attributes, inline event handlers, and javascript: URLs need context-aware escaping, so treat this as one layer rather than a complete XSS defence.

Encoding and decoding both run in this tab using the browser's own parser, so template fragments, email HTML, or snippets you are debugging are never sent anywhere.

That is the promise behind every tool here. Files are read in your browser tab, processed there, and discarded when you close it — never uploaded to our servers.