Encode and decode HTML entities and characters
The html encoder works like this: it escapes characters that have meaning in HTML (<, >, &, quotes) so code can be displayed as text, and unescapes entities back. Everything happens on your device - the input never leaves your tab unless the tool clearly states it performs a server-side lookup.
| Input | Result |
|---|---|
| <script>alert(1)</script> | <script>alert(1)</script> - displays as text instead of executing |
Text processing happens in your browser; nothing is uploaded.
Any time user content is shown on a page: comments, chat, code samples. Escaping is the first line of XSS defence.
Five: < > & " ' - they open HTML injection or break attribute syntax. Escaping just these renders any text safely as text, which is what the encoder emits.
Encode when displaying code or user content as visible text; decode when you have an entity-laden source (like a scraped RSS feed) and need the original characters back.
Zoven offers 200+ free browser tools. Browse by category - Calculators, Converters, Generators, Developer Tools and Media Tools - or read workflow guides on the Zoven blog.