Web Security
HTML Entity Encoder & Decoder
Cross-site scripting is an output-encoding bug. This tool shows exactly what contextual HTML escaping does to a payload, and decodes entity-obfuscated strings you find in phishing pages and logs.
Nothing is rendered as live HTML and nothing is uploaded -- the payload is only ever shown as escaped text inside your browser.
Encoding is context-specific
- HTML body: escape & < > " ' -- exactly what the first output above does.
- HTML attribute: quote the attribute and escape the same characters; unquoted attributes are exploitable even when escaped.
- Inside <script> or an event handler: HTML escaping is not enough. Use JSON serialisation or keep untrusted data out of script context entirely.
- URL parameters need percent-encoding, not entity encoding -- mixing the two is a classic bypass.
- Defence in depth: add a strict Content-Security-Policy so a missed escape does not become a working exploit.
Related tools
URL Encoder / Decoder
Percent-encode and decode URLs and query parameters used in web security work.
JWT Decoder
Inspect the header, payload, algorithm and claims of a JSON Web Token locally.
Number Base Converter
Convert between binary, octal, decimal and hex with byte and permission views.