About the HTML Entity Encoder / Decoder
HTML entities let you safely display reserved characters — like <, >, &, and quotation marks — inside HTML without the browser interpreting them as markup. Instead of a literal <, you write <, and the browser renders it as the character itself rather than the start of a tag.
This tool converts plain text into its entity-escaped equivalent, and converts entity-encoded HTML back into readable text.
How it works
- Paste your text or HTML snippet into the input box.
- Click Encode to escape special characters into named HTML entities, or Decode to convert entities back into their literal characters.
- Use the output directly in your HTML source or wherever the escaped form is needed.
Common use cases
- Displaying code samples: Encoding a snippet of HTML or XML so it displays as visible text on a page instead of being rendered as actual markup.
- Preventing basic HTML injection: Escaping user-submitted text before inserting it into an HTML page, so a value like `<script>` shows up as text, not executable markup.
- Reading scraped content: Decoding entity-heavy text pulled from an API or scraped HTML (e.g. `&` back into `&`) to get clean, readable text.
Frequently asked questions
Does entity-encoding text make it safe from XSS?
Encoding the five characters this tool handles (&, <, >, ", ') covers the most common HTML-injection vector, but real XSS prevention depends on context — attribute values, JavaScript contexts, and URLs each need their own escaping rules. Use a framework's built-in escaping or a dedicated sanitization library for production security, not manual encoding alone.
What's the difference between < and <?
They represent the same character (<) — < is a named entity, while < is the equivalent numeric character reference. Browsers treat them identically.
Why didn't my decode fully restore special symbols like em dashes or emoji?
This decoder relies on the browser's own HTML parser, so it correctly handles the full HTML5 entity set, including numeric references — if something looks off, check that the entity name or number was copied completely, without truncation.
Should I encode plain text that has no HTML in it?
Only the five characters with special meaning in HTML get changed (&, <, >, ", '); ordinary letters, numbers, and punctuation pass through unchanged.
This tool runs entirely in your browser — nothing you enter is sent to a server. Read more in the Privacy Policy, or browse the full list of tools.