HTML entity encode & decode
Escape < > & " for safe HTML, or turn entities back into readable text.
Escaping for safe HTML
Characters like < and & mean something to the HTML parser, so showing them as text needs entities. Unescaped user input in a page is the classic route to cross-site scripting, which is why escaping on output matters.
The decoder hands the text to your browser's own HTML parser, so it understands every named entity HTML5 defines (©, é, … and about 2,000 more) as well as decimal and hexadecimal numeric entities such as A and 😀, exactly as a browser would show them. Unknown names are left untouched. Nothing in the input is ever run as markup.
Frequently asked questions
Which characters must be escaped in HTML?
At minimum &, < and > in text, and also " inside double-quoted attributes. Escaping ' as well keeps single-quoted attributes safe.
Does escaping prevent XSS?
Escaping user input for the HTML context it is placed in is the core defence against cross-site scripting. Different contexts (attributes, URLs, JavaScript) need different escaping, so prefer a templating library that does it for you.
What is ?
A non-breaking space (U+00A0). It looks like a space but stops the line from wrapping there, and browsers do not collapse repeated ones.
How do I escape HTML in Java?
Use HtmlUtils.htmlEscape from Spring, StringEscapeUtils.escapeHtml4 from Apache Commons Text, or the OWASP Java Encoder.