HTML entities encoder and decoder

Escaping these five is enough to put any text safely inside HTML. Tick Also encode every non-ASCII character if the page’s encoding isn’t UTF-8, or for email.

1. Pick Encode or Decode.
2. Paste the text.
3. Copy the result.

Does decoding know every named entity?

Yes: it uses your browser’s own HTML parser, which knows all 2,231 named entities, as well as numeric ones like 😀.

Is escaping enough to stop XSS?

For text inside HTML elements, yes. Inside attributes, URLs, scripts or CSS, different rules apply: use your framework’s escaping for each place.