⚡ Named Entities • Numeric Hex & Decimal • XSS Sanitization
HTML Entity Encoder, Decoder & Sanitizer
Safely escape special characters to prevent Cross-Site Scripting (XSS) vulnerabilities. Converts symbols into standard named entities, decimal escapes, or decodes them back to plain text.
📝 Input String
|
🚀 Transformed Output
Input Length 0 chars
Output Length 0 chars
Why Entity Encoding is Critical for Web Security
1. Mitigating Reflected XSS
Unsanitized query parameters reflected directly into HTML allow attackers to inject malicious <script> tags. Encoding < as < neutralizes script execution completely.
2. Attribute Injection Protection
Quoting input values inside HTML attributes without escaping quotes allows attackers to escape the attribute via " onmouseover="alert(1). Escaping quotes to " guarantees safe attribute boundaries.
3. Zero-Dependency Client Execution
All transformations occur 100% inside your browser using native DOM parsing APIs. No proprietary payloads or sensitive tokens are ever transmitted across external networks.