Paste escaped HTML to turn entities back into characters: named (é), decimal (€) and hex (😀), using the full HTML5 table (2,231 entries). Text escaped twice, non-breaking spaces, and URLs whose ©= turned into © are pointed out.
Encode a file:
Inside HTML, & and < must always be escaped as & and <, and inside an attribute value the quote that wraps it must be escaped too. The Text + attrs variant escapes all five (& < > " '), which is safe in both places and is what server-side escapers do. Measured on Tom's <b>"A&B"</b>:
html.escape(): Tom's <b>"A&B"</b>htmlspecialchars(): the same, but with ' for the apostrophe. Invalid UTF-8 input is silently replaced by U+FFFD (�), so a Latin-1 é is lost rather than reported.htmlentities() also turns every accented letter and symbol into a named entity (café — 5€). On a UTF-8 page that is unnecessary; the + non-ASCII variant writes numeric references (é) instead, for the rare case where the output must be pure ASCII (old email systems, a page served as Latin-1).Text only leaves quotes as they are, which is fine between tags but unsafe inside an attribute. JavaScript has no built-in escaper: setting textContent instead of innerHTML avoids the need for one.
An unescaped & in a URL is the classic decoding surprise. HTML recognizes some old entities even without the closing semicolon, so in page text ?id=1©=2&lang=en¬=3 is read as ?id=1©=2&lang=en¬=3. Measured in Chromium: the same string in an href attribute is kept as it is, but as text it gets the © and ¬. Python's html.unescape() gives ©=2 too; PHP's html_entity_decode() leaves it alone. This decoder works like page text and warns when a &name= was swallowed, so you can tell a URL from escaped text. In your HTML, write such URLs with &.
&lt; on the page. When the decoded result still contains entities, this page says so and offers to decode again.' in PHP: html_entity_decode() with its default HTML 4.01 table leaves ' undecoded (measured on PHP 8.5). Pass ENT_QUOTES | ENT_HTML5. This page uses the browser's full HTML5 table (2,231 entries). decodes to U+00A0, which looks like a space but is not equal to ' ', so string comparisons and splits on spaces fail. The decoder counts them.Decoding runs in your browser and never runs scripts: <script> or onerror in the input stays plain text.
Shotmint is a screenshot and PDF API. POST https://shotmint.creasework.com/v1/pdf with {"html": "…"} returns a PDF, and /v1/screenshot returns a PNG of any URL or HTML, rendered in real Chromium (1 credit each; 25 free renders a month, then €5 for 2,000 that never expire). Add response=url to get a link instead of the bytes, or put the URL in a query string with the encoding above. Scripts, AI agents and Make or Zapier can get a key with a bare POST https://shotmint.creasework.com/v1/keys/free (no body, JSON reply); request bodies are described in openapi.json.
Get 25 free renders a month API docs
Is my text uploaded? No. Encoding and decoding run in your browser and nothing is sent to a server, so tokens, API keys and private data stay on your device.
Is Base64 encryption? No. Anyone can decode it; it only turns bytes into text that survives email, JSON and URLs, and makes the data about 33% bigger.
Related tools: Base64 encoder, Base64 decoder, JWT decoder, URL encoder, URL decoder, Text to hex converter, Hex to text converter, HTML encoder, JSON formatter, Image to Base64, Base64 to image.
URL encode / decode · Base64 encode / decode · PDF to HTML · HTML to image · HTML to PDF · HTML formatter · Word to HTML · HTML to Markdown · HTML to Word · Markdown to HTML · Online HTML editor · HTML viewer · HTML Beautifier · HTML Encode · HTML Minifier · HTML to DOCX · HTML to JPG Converter · HTML to PNG Converter · all free tools