Does encoding entities prevent XSS on its own?

It prevents injection into HTML text and attribute contexts, but JavaScript and URL contexts need different encoding. Use a sanitiser and framework escaping for untrusted input.

Why does & sometimes appear on my page?

That is double encoding — text that was already escaped got escaped again. Decode once with this tool, then let your template handle escaping a single time.

Developer Tools

HTML Entity Encoder & Decoder

Convert reserved characters like < > & " into safe HTML entities, or decode an entity-encoded string back to readable text.

Also encode all non-ASCII charactersInputOutput

&lt;script&gt;alert(&quot;hi &amp; bye&quot;)&lt;/script&gt;

100% private

This tool runs entirely in your browser. Nothing you type is uploaded, logged or stored.

Escaping Special Characters and Preventing XSS

HTML reserves a handful of characters for markup. An unescaped `<` starts a tag, an unescaped `&` starts an entity reference, and quotes terminate attribute values early. Escaping converts them to entities — `<`, `>`, `&`, `"` and `'` — so the browser renders them as literal text rather than interpreting them as structure. This is why code samples, user comments and imported CMS content so often break a layout when pasted raw.

The security dimension is more serious. Cross-site scripting happens when untrusted input is written into a page without escaping, letting an attacker inject a script tag or an event-handler attribute that runs with your site's privileges. Contextual escaping is the fix: HTML-escape text inserted into element content, additionally escape quotes for attribute values, and use entirely different encoding rules for JavaScript and URL contexts. Never build markup by string concatenation with user data.

In practice, prefer framework primitives that escape by default — React's JSX text nodes, template engines with auto-escaping, or setting textContent instead of innerHTML. Reserve manual entity encoding for cases where you genuinely need to display markup as text, such as documentation and email templates. Anything that renders raw HTML from user input should be sanitised with a maintained allowlist library rather than a regular expression.

Frequently asked questions

Ampersand, less-than and greater-than in text content, plus double and single quotes inside attribute values. Escaping those five prevents almost all markup breakage.