Enkoder HTML
Encode special characters to HTML entities or decode them back
HTML / Text Input
Encoded Output
Common HTML Entities
&Ampersand<Less than>Greater than"Double quote'Single quote©Copyright®Registered™Trademark Non-breaking space–En dash—Em dash‘Left single quote’Right single quote“Left double quote”Right double quote°Degree±Plus-minus×Multiply÷Divide≠Not equalTentang alat ini
Five characters carry structural meaning in HTML, and putting any of them into a page as literal text requires encoding them first. The angle brackets open and close tags. The ampersand starts an entity. Quotes delimit attribute values. Encoding replaces each with a named entity - &lt; for a less-than sign, &amp; for an ampersand - so the browser renders the character instead of interpreting it as markup. Two situations make this matter. The obvious one is displaying code examples on a page, where unencoded markup simply disappears into the DOM instead of showing. The serious one is security: cross-site scripting works precisely because user-supplied text containing a script tag gets treated as markup rather than as words. Encoding on output is the standard defence. It is worth being clear that encoding alone is not complete XSS protection - context matters, and text inside a script block or a URL attribute needs different handling - but it is the foundation. This runs in your browser.
Cara menggunakan alat ini
- Choose encode or decodeEncode makes text safe to place in HTML; decode turns entities back into readable characters.
- Paste your textA code sample, a snippet of user content, or entity-laden text you want to read.
- Read the resultEncoding converts the five reserved characters; decoding reverses named and numeric entities.
- Copy it into your page or templateEncoded text renders as literal characters rather than being parsed as markup.
Mengapa menggunakannya
- Handles all five reserved characters correctly rather than only the obvious angle brackets.
- Works both directions, so you can read entity-encoded content as well as produce it.
- Runs in your browser, so content being sanitised is never transmitted.
- No length limit and no account.
- Useful for both display and as part of an output-encoding security habit.
Penggunaan umum
- Showing HTML or XML code examples on a web page.
- Escaping user-generated content before rendering it.
- Reading an entity-encoded string from a database or API response.
- Preparing text for an HTML attribute where quotes would break out.
- Debugging why a snippet renders as markup rather than as text.
Tips untuk hasil lebih baik
- Encode on output, not on input. Storing encoded text makes it wrong for every non-HTML context - emails, APIs, PDFs - and double-encodes when rendered.
- The ampersand must be encoded first, or encoding the others produces &amp;lt; instead of &lt;.
- Encode quotes when text goes into an attribute value. Unescaped quotes let content break out of the attribute entirely.
- HTML encoding is not enough inside a script block or a URL - those contexts need JavaScript and URL encoding respectively.
- In a framework like Angular or React, output is escaped automatically. Manual encoding there usually means double-encoding.
Kesalahan yang harus dihindari
- Treating HTML encoding as complete XSS protection. It is one layer; context-appropriate encoding and a CSP matter too.
- Encoding on input and storing the encoded form, which corrupts the data for every other use.
- Double-encoding, so users see &amp;lt; on the page instead of a less-than sign.
- Forgetting to encode quotes in attribute values, which is a genuine injection vector.
- Manually encoding inside a framework that already escapes output, producing visible entity codes.
Pertanyaan yang sering diajukan
In HTML, < and > are used to define tags - if you want to display them as literal text (like showing example code on a webpage), they need to be encoded as entities so the browser doesn't try to interpret them as markup.
Proper HTML encoding of user-generated content is one part of preventing XSS, since it stops malicious markup from being interpreted as active HTML - but full XSS prevention in an application involves broader security practices beyond just this encoding step.
Encoding turns reserved characters into entities so they render as text. Decoding reverses it, turning entities back into the characters they represent - useful when reading content pulled from a database or API.
Five: & becomes &amp;, < becomes &lt;, > becomes &gt;, " becomes &quot; and ' becomes &#39;. The ampersand must be handled first, or encoding the others produces double-encoded output.
When displaying. Store the raw text and encode at output, because the correct encoding depends on where the text is going - HTML, a URL, JSON and an email all need different treatment. Encoding on input locks you into one of them.
Double encoding. The text was encoded twice, so the ampersand of the first entity was itself encoded. Usually it means encoding was applied on input and again on output, or applied manually inside a framework that already escapes automatically.
Yes. HTML Encoder is free for normal use with no account required, and ToolBox does not add a watermark to your result.
Most tools in this category run in your browser so the file stays on your device. If a tool needs a temporary server job, files are handled for that job only and are not kept as a lasting archive.
Orang juga mencari
- html encoder decoder online
- escape html characters
- html entities converter
- prevent xss encoding
- convert special characters html
- html entity list
- decode html entities