HTML Entity Encoder/Decoder
Encoders & DecodersEncode special characters to HTML entities (&, <, ", ©) or decode entities back to their literal characters.. Free, private — all processing in your browser.
Convert text to HTML entities and back. Paste code or text to encode the characters that would otherwise break your markup — < > & and quotes become &lt; &gt; &amp; — or paste entity-encoded HTML to decode it back to readable characters. It processes as you type, with a reference table of common entities you can click to insert.
Why this matters: if you want to display literal HTML on a page (a code example, a snippet in a tutorial), you can't just drop < and > into the markup — the browser would try to render them as tags. Encoding them as entities makes the browser show the characters instead of interpreting them. Encoding is also the baseline defense against injecting untrusted text into HTML.
Encode has two modes: escape only the special characters (the common case, keeps text readable), or encode every character as a numeric entity (useful for obfuscation or forcing a specific representation). Decode handles named, numeric, and hex entities alike.
How to use the HTML Entity Encoder/Decoder
- 1
Pick direction
Encode text to entities, or decode entities back to text.
- 2
Paste your content
Drop the text or entity-laden content into the input.
- 3
Set encoding strategy
For encoding: choose minimal (essentials only), standard, or maximum (all non-ASCII).
- 4
Review the preview
See how the encoded text renders in a browser alongside the raw entity form.
- 5
Copy
One-click copy the result for pasting into your code or document.
HTML Entity Encoder/Decoder — examples
Essential escaping
Minimal encoding of HTML-dangerous characters.
<p>Hello & welcome</p>
<p>Hello & welcome</p>
Copyright symbol
Encoding a non-ASCII character.
© 2026 Tooleras
© 2026 Tooleras or numeric: © 2026 Tooleras
Decoding
Entities back to literal characters.
Tom & Jerry said "hi"
Tom & Jerry said "hi"
Mixed forms
Named and numeric entities handled together.
© by Don't © 2024
© by Don't © 2024 (three entity forms all decoded)
XSS prevention
Encoding user input safely for HTML.
<script>alert("XSS")</script><script>alert("XSS")</script> (safe to embed in HTML)
Features at a glance
Two-way conversion
Encode text to entities or decode entities back to text in one tool.
Named and numeric forms
Handles ©, ©, and © — all three forms of the same character.
Encoding strategies
Minimal (just & < >), standard, or maximum (all non-ASCII) depending on your safety needs.
250+ named entities
Full HTML5 named entity list including Greek letters, arrows, and typographic marks.
XSS-safe encoding
Minimal mode matches the escaping strategies of React, Angular, and major templating engines.
Preview
See how the encoded text will render in a browser before using it.
Copy-ready output
One-click copy the encoded or decoded result for pasting into code or content.
Client-side only
Input text never leaves your browser — safe for sensitive content.
When to use the HTML Entity Encoder/Decoder
Web development
- →User input sanitization: Encode text from user input before embedding in HTML to prevent XSS attacks.
- →CMS content embedding: Convert special characters in CMS content to entities so they display literally rather than being parsed as markup.
- →Email HTML: Prepare content for HTML email templates where some email clients strip non-entity special characters.
Content processing
- →Decode scraped content: Convert HTML-encoded text from scraped pages back to readable form.
- →Email archive extraction: Turn entity-laden email archives into plain readable text.
- →Documentation cleanup: Decode raw HTML source pulled from exports to more readable form for editing.
Data interchange
- →XML vs HTML: Convert between HTML and XML-safe forms (some entities differ).
- →JSON embedding: Ensure special characters in JSON strings are entity-escaped where needed.
- →API payload cleaning: Strip or encode special characters in text fields before API submission.
Under the hood
Special-character encoding replaces the HTML-significant characters: & becomes &amp;, < becomes &lt;, > becomes &gt;, double quote becomes &quot;, single quote becomes &#39;, and forward slash becomes &#x2F; (slash escaping is a defensive practice that helps prevent breaking out of attribute contexts). The "all characters" mode instead emits every character as a numeric entity in the &#N; form, where N is the Unicode code point.
Decoding uses the browser's own HTML parser: the input is assigned to a textarea's innerHTML and read back as text, so it correctly resolves the full range of named entities (&copy;, &mdash;, &nbsp; and hundreds more), plus decimal (&#169;) and hexadecimal (&#xA9;) numeric references — exactly as a browser would. That makes decoding robust across any valid entity, not just a hardcoded list.
Everything runs locally in your browser; nothing you paste is uploaded.
Pitfalls and fixes
⚠Don't double-encode
If your framework or template already auto-escapes HTML (React, Vue, most server templates do), encoding again here produces &amp;lt; instead of <. Encode manually only for raw output that isn't already escaped.
⚠Entity encoding isn't full XSS protection
Escaping for HTML body context is the baseline, but attributes, URLs, JavaScript, and CSS each need their own escaping. Encoding HTML entities alone doesn't make untrusted input safe in every context.
⚠'All characters' mode bloats the output
Encoding every character as a numeric entity multiplies the size several times over. It's for obfuscation or forcing a representation, not for normal HTML — use 'special chars only' for real markup.
⚠Encoding is context-specific
The right escaping depends on where the text goes. This encodes for HTML content; putting the result into a JavaScript string or a URL needs different escaping (JS string escaping or URL encoding).
⚠Decoding runs the browser's parser
Because decode uses the browser's HTML parsing, it resolves entities exactly as a page would — including obscure named ones. That's accurate, but means decoding assumes the input is HTML-entity text, not some other escaping scheme.
How it compares
Encoding entities by hand is error-prone — it's easy to escape the angle brackets but forget the ampersands, which then double-encode or break. This does it consistently in both directions, and the browser-based decoder handles every entity a real browser would, not a limited subset.
For output in a live application, your template engine or framework almost always auto-escapes HTML for you (React, Vue, and server templates do this by default), and you should rely on that rather than manually encoding — manual encoding on top of auto-escaping causes double-encoding bugs. Use this tool for one-off jobs: preparing a code sample to display, decoding entity-laden text you received, or checking what a given entity resolves to.
HTML Entity Encoder/Decoder — FAQ
▶What are HTML entities?
They're codes that represent characters which have special meaning in HTML (like < > &) or that are hard to type. Writing < tells the browser to display a literal < instead of starting a tag. They come in named (&), decimal (&), and hex (&) forms.
▶When do I need to encode HTML entities?
When you want to display literal HTML or special characters on a page — a code sample, or user text — without the browser interpreting them as markup. It's also a baseline step for safely putting untrusted text into HTML content.
▶What's the difference between the two encode modes?
'Special chars only' escapes just the characters that affect HTML (& < > and quotes), keeping the rest readable — this is what you normally want. 'All characters' encodes every character as a numeric entity, which is used for obfuscation or forcing a specific representation.
▶Does decoding handle all entity types?
Yes. Decoding uses the browser's HTML parser, so it resolves named entities (like ©, —), decimal references (©), and hexadecimal references (©) the same way a web page would.
▶Should I use this instead of my framework's escaping?
For live application output, rely on your framework's automatic escaping (React, Vue, server templates) to avoid double-encoding. Use this tool for one-off tasks like preparing a snippet to display or decoding entity-encoded text you received.
Useful references
- HTML5 entity reference — MDN HTML entities reference with complete list of named entities.
- OWASP XSS Prevention — Security context for why HTML encoding matters for user input.
- W3C HTML5 named characters — Authoritative list of all HTML5 named character references.
- React escape semantics — Context for why frameworks escape by default and how to bypass when needed.
- XML entity reference — XML’s more limited entity set compared to HTML.
Related tools
All Encoders & DecodersBase64 Encoder/Decoder
Encode and decode Base64 strings, files, and images instantly
Character Map
Browse and copy any Unicode character including emoji, symbols, arrows, mathematical signs, and non-Latin scripts.
Hex to Text Converter
Convert hexadecimal byte sequences to readable ASCII or UTF-8 text with flexible input formatting.
HTML Formatter
Format, indent, and beautify HTML, XHTML, and HTML5 markup
HTML Minifier
Compress HTML by removing whitespace, comments, optional tags — 20-40% smaller
HTML to Markdown
Convert HTML to clean, readable Markdown preserving structure and formatting
Learn more
Explore more tools
200+ free tools that run in your browser.
Browse all tools →