How to use this tool
Encoding escapes ampersand, angle brackets, double quotes and apostrophes. Decoding uses the browser’s character-reference handling in a detached textarea and displays the result as text. The tool never renders the decoded markup as a page. HTML character escaping is not a general sanitizer for every programming or URL context.
Try these values
<b>hello</b> becomes <b>hello</b> when encoded. Decoding returns the literal tag text rather than displaying it in bold.
Common questions
Is this a complete HTML sanitizer?
No. Different output contexts need different protections. Do not treat decoding or escaping as a universal security check.
Will decoded scripts run?
No. The result is inserted as plain text, not executed or rendered as markup.
Something doesn’t add up? Report an issue · Methods & corrections