How it works
Encoding protects text from being interpreted as markup in a text context. It is not a complete XSS defense; use context-aware escaping in applications.
Replace &, <, >, ", and ' with named HTML entities.
Debugging scenario
Encode an untrusted display string containing ampersands, angle brackets and quotes, then place the result only in an HTML text-node test. For attributes, URLs, JavaScript, CSS or allowed rich HTML, use the framework encoder or sanitizer designed for that exact context.
How to interpret the result
Encoding replaces a small set of characters so text is not parsed as markup in a basic text context. Decoding reverses common entities and can recreate markup characters. Neither operation decides which elements, attributes, protocols or script behaviors are safe.
Input reference
- Mode
- Example default: Encode
- Input
- Example default: Sample input included
Common mistakes
- Pasting secrets, credentials, customer records or other production data into a browser tool or shareable URL.
- Using text-node escaping as a complete sanitizer for attributes, URLs, scripts, styles or rich HTML.
- Treating a convenient preview as validation by the target runtime, parser, database or security control.
Before using the result
- Reduce the input to a synthetic example that still reproduces the behavior.
- Use context-aware framework escaping and an allowlist sanitizer where markup is permitted.
- Add the accepted input and expected output to the project regression tests before release.
Questions to check before production use
Does encoding sanitize HTML?
No. It escapes text for a context; it does not remove unsafe HTML or scripts.
Is input sent to a server?
No. Processing runs in the browser.
Independent developer utility. Review output before using it in production.