Encode and decode HTML entities. Supports named entities (&), numeric (&), and hex (&) formats. Escape special characters for HTML.
Encode special characters into HTML entities or decode entities back to readable text. Handles named entities (&), numeric (&), and hex (&) formats.
Initializing in your browser…
Generate ultra-secure passwords with presets (Simple to Paranoid), strength analysis, entropy calculation, crack time estimation, password history, and bulk generation
Analyze password security with 10 criteria checks, entropy calculation, crack time estimation, character breakdown, warnings, and improvement suggestions
Generate realistic fake data for testing and development. Create names, usernames, emails, addresses, phone numbers, and more. Export to JSON or CSV format
You need to show a literal code snippet containing tags and quotes inside an HTML page without it being parsed as markup.
Raw text
<script>alert("Tom & Jerry")</script>Entity-encoded
<script>alert("Tom & Jerry")</script>
The five characters that break (or exploit) HTML, `< > & " '`, are replaced with their named entities so the browser renders them as text instead of executing or mis-parsing them. This is the exact transformation that prevents reflected XSS when untrusted text lands in markup; the tool also decodes in the other direction.
Encode special characters into HTML entities or decode entities back to readable text. Handles named entities (&), numeric (&), and hex (&) formats.
Whenever you're inserting user-provided text into an HTML page. Encoding prevents XSS attacks and rendering issues from characters like <, >, and &.
Named entities like & are easier to read. Numeric entities like & work for any Unicode character, including those without a named form.
This runs as client-side JavaScript. Keys, tokens, payloads, and other inputs never leave your device.