HTML Entity Converter
Escape text so it displays safely in HTML — or decode entities like < back into real characters.
Why escaping matters for security
HTML reserves <, > and & for markup. If you display user-supplied text without escaping it, a visitor can inject markup — the doorway to XSS (cross-site scripting) attacks, one of the most common web vulnerabilities. Escaping converts those characters to harmless entities (<, >, &) so browsers render them as text instead of executing them. Rule of thumb: escape on the way out to the page, decode only trusted content.
Frequently asked questions
Which characters get escaped?
The five XML-reserved characters: &, <, >, " and ' — the set that makes text safe in both element content and attributes. Accented letters and emoji are left alone, since they are valid in UTF-8 documents.
Decode failed on my string — why?
Malformed entities like a stray & followed by spaces can throw the parser off. Try encoding first, then decoding, to normalise the input.