Does this prevent XSS?

Encoding helps when inserting untrusted text into HTML, but XSS prevention also depends on context (attributes, JS, URLs). Prefer a trusted sanitizer for rich HTML.

HTML Entity Encode / Decode

Convert special characters to HTML entities and back. Free, private, and runs in your browser.

Processed locally in your browser — nothing is uploaded.

Input

Output

&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt; &amp; more

Loading tool…

About this tool

Escape HTML special characters to entities (and back) to safely display markup as text. Useful when debugging templates or preventing accidental HTML injection in plain-text contexts.

Frequently asked questions

Does this prevent XSS?: Encoding helps when inserting untrusted text into HTML, but XSS prevention also depends on context (attributes, JS, URLs). Prefer a trusted sanitizer for rich HTML.