How to encode and decode HTML entities
Turn <, &, and quotes into entities (or back) so example markup can sit in HTML text — not a sanitizer and not a formatter.
Encode for literal text
HTML Encode / Decode at /tools/html-encode-decode in Encode mode replaces &, <, >, ", and ' with &, <, >, ", and '. Use it when you want to show a tag as text in a blog or docs page. It does not encode every Unicode character as numeric entities. Decode reverses those common entities. In the browser, decode uses a textarea’s HTML parsing; that is convenient and not a security boundary.
Steps
1) Open HTML Encode / Decode. 2) Choose Encode or Decode. 3) Paste the snippet — output updates as you type. 4) Copy the result into your template. If you needed pretty-printed tags, use HTML Formatter after you decide whether the file is markup or escaped text.
Not a XSS filter
Encoding a string for display is one step. It does not make untrusted HTML safe to innerHTML. DOMPurify-style sanitization is a different job (Markdown Preview sanitizes its preview). URL Encode percent-encodes query values, not HTML. XML Formatter is for XML documents, not entity teaching.
Worked example
Encode <div class="x"> becomes <div class="x">. Decode that string to get the original. Encode & first in your mental model: if you encode < before & you can double-encode; this tool always encodes & first so a raw & in the source becomes &. Double-decoding &amp; will surprise you — decode once unless you meant nested escapes.
Related encoding tools
Base64 Encode / Decode for transport alphabets. Hex Encode / Decode for bytes. URL Encode / Decode for query strings. Image ↔ Base64 for pictures. None of those escape HTML.
Privacy
Snippets stay in the tab. Related: /tools/html-formatter, /tools/url-encode, /tools/base64-encode. Close the page if the markup includes internal URLs.