A product name with an ampersand pasted into a CMS becomes a broken attribute. HtmlShift encodes and decodes HTML entities so you can paste safely into pages and CMS fields. Use it for snippets, for titles with < and &, for decoding a mess you inherited. Do not use it as a sanitizer that makes untrusted HTML safe, as a full page editor, or as a Markdown compiler. Encoding a script tag does not mean you should then decode it into a public comment field. MarkdownShift previews Markdown. MetaShift emits tags. This page is the entity booth.
Encode: < becomes <, & becomes &. Decode reverses. Named vs numeric entities can both appear. Attribute context vs text context still matters: quotes in attributes need their own care. A tool that encodes the whole paste for text content may be wrong inside an href. Know which hole you are filling.
When not to use it: XSS defense for a product. Use a real sanitizer or a framework that encodes by default. Also skip huge HTML documents; this is a snippet tool. YamlShift and JsonShift are for those languages. Color hex is ColorShift, not an entity. Double encoding that shows &amp; means the CMS already encoded; look at view-source, not only the render.
Privacy is local. Unreleased copy with weird punctuation can be encoded without a 'html encoder' host logging it. If you decoded a stolen page, that is still copyrighted on your screen. Close the tab. Do not encode an entire template or you will display tags to the user instead of rendering them.
Title: 'Widgets & Gizmos <beta>.' Encode: Widgets & Gizmos <beta>. The CMS stores it, the page renders correctly. A second paste is a full article with tags you wanted to keep; encode-all would have wrecked it. You only encode the title field. Nothing uploaded. Encoding only the title field keeps the article tags intact; encode-all would have wrecked the body. A sanitizer is for HTML you do not own; encode is for text you own that contains < and &.
HtmlShift encodes and decodes in the browser. Snippets stay on the device. There is no paste log. Close the tab when the string is in the CMS. There is no paste log; close the tab when the string is in the CMS and the preview looks like text, not source.
Full policy: Shift Privacy Policy. Questions: [email protected].
Encode is for text you own that contains < and &. A sanitizer is for HTML you do not own. They are not interchangeable. This tool is encode/decode. Encode is for your own text with < and &; a sanitizer is for other people's HTML; they are not interchangeable.
Double encoding. Decode once or stop encoding fields the CMS already encodes. Look at view-source, not only the rendered page. If you see &amp;, decode once or stop encoding a field the CMS already encodes on save.
No. Encode the text bits. Tags must remain tags in a template. Otherwise you will display source to the user. Templates must keep tags as tags; encoding the whole file is how you teach the browser to show markup.
Both decode to the same character if the name is standard. Stick to & < > " in old HTML. Unicode characters in UTF-8 pages often do not need entities at all.
Related tools: MarkdownShift · MetaShift · YamlShift
Guides · All Shift tools · About · Contact