HTML entity encoder / decoder
Escape the five OWASP-mandated characters (or every non-ASCII). Decode named entities, decimal references, and hex references. Warns when input looks double-encoded.
Plain text
When to encode: before inserting user-supplied text into HTML body content. The five characters are &, <, >, ", and '. For attribute values, use the same escaping; for <script>bodies, use a JSON-safe escape instead. Extended mode adds numeric references for every non-ASCII character — handy when the downstream system can't handle UTF-8 directly.
Keep hardening your site
This is one check of many. Run the rest — every tool is free, no account.
Security headers scan
Grade your live response headers
TLS certificate scan
Grade chain, expiry, and key strength
Security headers builder
Emit a ready-to-paste header block
CSP analyzer
Grade your Content-Security-Policy
Cookie security audit
Check Secure, HttpOnly, SameSite
Mixed-content scanner
Find http:// assets on https pages
Open-redirect detector
Probe redirect params for abuse
HSTS preload checker
Grade against Chrome's preload list