HTML Entity Encoder / Decoder
Encode special characters to HTML entities and decode named or numeric entities back to text — live, free and fully in-browser.
About the HTML Entity Encoder / Decoder
This HTML entity converter escapes and unescapes text live as you type. In the encoding direction it converts the five HTML-critical characters — & < > " and ' — into their entity forms (&, <, >, ", ') so any string can be displayed safely inside an HTML page without being interpreted as markup.
An optional checkbox also converts every non-ASCII character — accents, emoji, arrows, CJK text — into numeric hex entities like é, useful when your toolchain or email templates can't be trusted with UTF-8. Decoding understands both named entities ( , ©, é) and numeric ones (©, ©) using the browser's own HTML parser, so it handles everything a real browser would.
It runs entirely on your device, making it a quick, private way to prepare code snippets for blog posts, fix double-encoded text and inspect scraped HTML.
How to Use the HTML Entity Encoder / Decoder
- 1Type plain text on the left to encode it to HTML entities live.
- 2Or paste encoded HTML on the right to decode it back to text.
- 3Tick the checkbox to also encode non-ASCII characters as hex entities.
- 4Copy either result with the copy buttons.
Frequently Asked Questions
Which characters must be escaped in HTML?
At minimum & (as &), < (as <) and > (as >) in element content, plus " (as ") and ' (as ') inside attribute values. The ampersand always comes first when encoding, otherwise you'd double-escape the entities themselves. This tool escapes all five automatically.
How do I display code snippets on a web page without them executing?
Encode the snippet with this tool before pasting it into your HTML. <script> becomes <script>, which browsers render as visible text instead of running it. This is the standard way to show HTML, JavaScript or XML examples inside a blog post or documentation page.
What is the difference between named and numeric entities?
Named entities use a mnemonic (© for ©, for a non-breaking space) and only exist for a defined list of characters. Numeric entities reference a Unicode code point directly, in decimal (©) or hexadecimal (©), and can represent any character. The decoder here understands all three forms.
Does encoding entities protect against XSS attacks?
Escaping user input before inserting it into HTML content is one of the core defences against cross-site scripting, yes. But context matters: attribute values, URLs, CSS and JavaScript contexts each need their own escaping rules. Use this tool to understand and test the encoding; in production, rely on your framework's auto-escaping.