HTML-Entity-Encoder / -Decoder
HTML-Sonderzeichen sicher kodieren oder kodierten Text wieder in Klartext umwandeln. Die gesamte Verarbeitung erfolgt in Ihrem Browser; Ihre Eingaben werden nie an den Server gesendet.
When you want a browser to display <div> as text instead of creating a division, the angle brackets have to become < and >. That is HTML entity encoding, and it is also the front line against cross-site scripting: user input rendered without encoding is how script injection happens. This tool converts in both directions.
So funktioniert es
- Paste your text or markup into the input.
- Press Encode to turn &, <, >, " and ' into their entity forms — the five characters that matter for safe output.
- Press Decode to go the other way, turning &nbsp; and friends back into real characters.
- Copy the result into your template, documentation or code sample.
Häufige Fragen
- Which characters actually need encoding?
- Five: & < > " and '. Everything else is safe in HTML body text. Encoding more than these makes markup unreadable without adding safety.
- Is decoding here dangerous?
- No. The decoder reads the value out of a textarea element, so the content is never parsed as live HTML and no script can run.
- Does this protect my site from XSS?
- It is the right transformation, but protection comes from applying it at output time in your code, on every untrusted value. A one-off conversion in a browser tool does not secure an application.
- Why is my & turning into &amp;?
- You encoded text that was already encoded. Encode exactly once, at the point of output.