HTML Entity Encoder & Decoder
Escape text for safe use in HTML, or decode entities back into readable characters.
Processing: This tool runs entirely in your browser. Your input and any file you open stay on your device — nothing is uploaded to a server.
How to use the html entity encoder & decoder
- Paste your text or HTML.
- Choose Encode to escape it, or Decode to convert entities back.
- Copy the result.
About this tool
Five characters change meaning inside HTML: &, <, >, " and '. If they appear literally in content that is inserted into a page, the browser reads them as markup rather than text — which is how code samples break and how injection bugs start. Encoding replaces each with its entity so the browser renders the character instead of acting on it.
Decoding does the reverse, which is handy when text has passed through a system that escaped it twice and you are looking at &lt; where you expected <.
Common uses
- Embedding a code sample inside a blog post.
- Fixing double-escaped text from a CMS export.
- Preparing user-supplied strings for a template.
Frequently asked questions
- Is encoding here enough to prevent XSS?
- Escaping these characters is the right defence for text inserted into HTML element content, but attribute, URL, CSS and script contexts each need their own escaping. Use your framework's contextual escaping in production code.
- Does it encode every non-ASCII character?
- Only if you choose the full option. By default it escapes the five reserved characters and leaves accented letters and emoji as-is, which is correct for UTF-8 pages.
Related tools
URL Encoder & Decoder
Percent-encode text for safe use in URLs, or decode an encoded URL back to readable text.
Base64 Encoder & Decoder
Encode text to Base64 or decode Base64 back to text, with UTF-8 and URL-safe support.
JSON Formatter
Format, validate and minify JSON with clear error messages that point at the exact position.
Regex Tester
Test a regular expression against sample text with live highlighting and capture groups.