Docify

HTML encoder

Escape markup characters as HTML entities, or decode those entities back.

Docify's HTML tool escapes the five markup characters in your browser. Encode replaces & first, then <, >, ", and apostrophe as &#39; (not &apos;). Decode expands those named entities plus decimal or hex numeric character references. Encode and Decode are buttons, not as-you-type. Not URL encoding, not a sanitizer, and not the full HTML named-entity table. Nothing is uploaded.

Plain text
Encoded output

How it works

  1. Encode and Decode are buttons, not as-you-type. Load sample fills the input only. Copy writes the output. Nothing is uploaded.
  2. Encode replaces & with &amp; first, then < → &lt;, > → &gt;, " → &quot;, and ' → &#39;. Other characters stay unchanged.
  3. Decode expands &amp;, &lt;, &gt;, &quot;, and &apos;, plus well-formed &#decimal or &#x hex numeric character references via String.fromCodePoint for Unicode scalars 1–0x10FFFF (surrogates and out-of-range values stay as written).
  4. This is not encodeURI, not innerHTML, not a sanitizer, and not the full HTML named-entity list (&nbsp; stays &nbsp;).

FAQ

Does this tool upload my text?
No. Encode, decode, and copy run in your browser. The page does not send the text to a server.
Which characters does Encode escape?
Only the five markup-significant characters, and & is replaced first so a later pass cannot double-encode an entity. & becomes &amp;, < becomes &lt;, > becomes &gt;, " becomes &quot;, and ' becomes &#39;. Other characters, including non-ASCII, stay as themselves. This is not URL encoding and not a sanitizer.
Why is the apostrophe &#39; instead of &apos;?
&apos; is defined in XML and HTML5 but was not in HTML 4.01. Encode always writes the numeric reference &#39;, which every HTML and XML parser accepts. Decode still accepts &apos;, &#39;, and &#x27;.
What does Decode leave unchanged?
Decode expands those five named entities and well-formed decimal or hex numeric character references (&#60; or &#x3C;) into Unicode scalars. It does not expand the rest of the HTML named-entity table, so &nbsp; and &copy; stay as written. Malformed or out-of-range numeric references are left intact. This is not innerHTML, not a DOM parser, and not XSS protection.

Related