HTML Entity Encoder / Decoder
Escape & < > " ' as HTML entities so text displays safely inside HTML, or decode named and numeric entities back to plain text.
What the HTML entity encoder and decoder do
Encode replaces the five characters that have a special meaning in HTML — &, <, >, " and ' — with character references, so the text displays literally instead of being read as markup. Decode does the reverse for every reference a browser understands: named ones such as ©, decimal ones such as © and hexadecimal ones such as ©.
An HTML entity, properly called a character reference, starts with & and usually ends with ;. The HTML Standard defines 2,231 named references; 106 of those are legacy spellings without the final semicolon, kept for old pages. Numeric references can name any Unicode code point. XML, by contrast, predefines only five names: amp, lt, gt, quot and apos.
How to use it
- Type or paste text into the Input pane, or load a text or HTML file with File. URL loads from servers that allow cross-origin requests.
- Click Encode to escape special characters, or Decode to turn references back into characters.
- Copy the result, Download it as
encoded.txtordecoded.txt, or Clear both panes.
What Encode changes
| Character | Becomes | Why it must be escaped |
|---|---|---|
& | & | Starts a character reference. Replaced first, so nothing is escaped twice in one pass. |
< | < | Starts a tag. |
> | > | Ends a tag; escaped for symmetry and older parsers. |
" | " | Ends a double-quoted attribute value. |
' | ' | Ends a single-quoted attribute value. |
Everything else is left as it is, including accented letters, symbols and emoji: café © 2026 — 😀 comes out unchanged. A page served as UTF-8 (<meta charset="utf-8">) displays them correctly, so turning them into references only makes the source harder to read.
Example
<p class="note">Tom & Jerry's "show"</p>encodes to:
<p class="note">Tom & Jerry's "show"</p>Placed in a web page, that encoded string shows the original code as text rather than creating a paragraph, which is what you want when publishing code samples.
How Decode reads tricky input
Decoding uses your browser’s own HTML parser, so it follows the HTML parsing rules exactly, including the error-recovery cases. Tags in the input are treated as plain text and kept, never run. These results were produced on this page:
| Input | Decoded | Rule |
|---|---|---|
© © 😀 | © © 😀 | Decimal and hex references. |
& © <3 | & © <3 | Legacy names work without a semicolon. |
¬it; | ¬it; | The legacy name ¬ matches first. |
&bogus; | &bogus; | Unknown names are left alone. |
&, ' | &, ' | Both are defined names. |
€ | € | Codes 128–159 are mapped as Windows-1252. |
�, � | � | Invalid code points become U+FFFD. |
Escaping and security
Inserting untrusted text into a page without escaping is the classic cause of cross-site scripting (XSS). Escaping these five characters is the right defence for text between tags and for attribute values in quotes. It is not enough inside <script> blocks, event handler attributes, style attributes, unquoted attributes or URLs such as href="javascript:…", which need their own encoding or validation. The OWASP XSS prevention cheat sheet lists the rules for each context. In application code, prefer your template engine’s automatic escaping over manual replacement.
Common problems and fixes
| Symptom | Cause | Fix |
|---|---|---|
Page shows &lt; or &quot; | Text was escaped twice, for example once on save and again in the template. | Decode once here, then escape only when writing HTML. |
Encoding & gives &amp; | Encode treats existing references as plain text. | Decode first if the input is already partly escaped. |
| A reference shows literally in the browser | The name is misspelt or unknown, e.g. &nbps;. | Check the name in the HTML Standard’s list, or use the numeric form. |
breaks an XML or RSS file | XML has no HTML named references. | Use   or the character itself. |
| URL query string still breaks | HTML escaping does not percent-encode. | Use the URL Encoder for parameters, then HTML-escape the full URL. |
Frequently asked questions
Why does the encoder use ' instead of '?
Both mean an apostrophe in HTML today, but ' was not defined in HTML 4, so the numeric ' is understood by every HTML parser and email client.
Should I encode accented letters and emoji?
Not for a page served as UTF-8, the standard encoding for the web. Numeric references are only worth it when a file must stay pure ASCII, for example for an older system that mangles other characters.
Is decoding safe with untrusted HTML?
Yes. The input is parsed as text inside a detached element and the result is shown in a plain text box, so tags and scripts in it are never rendered or run.
What is the difference between HTML escaping and URL encoding?
HTML escaping protects characters that are special to the HTML parser. URL (percent) encoding protects characters that are special in a URL, turning a space into %20. A link inside HTML may need both.
Is my text uploaded?
No. Encoding is a simple text replacement and decoding uses the browser’s parser; both run on your device and nothing you enter is sent anywhere.