HTML Encoder & Decoder
Turn any text into safe HTML entities — and turn entities back into readable text — without leaving your browser.
Escape only the five critical characters (& < > " ')
Quick reference
| Character | Named entity | Numeric entity |
|---|---|---|
| & | & | & |
| < | < | < |
| > | > | > |
| " | " | " |
| ' | ' | ' |
| © | © | © |
| € | € | € |
| — | — | — |
Everything runs locally in your browser using native JavaScript — your text is never uploaded or stored.
How to Encode and Decode HTML Entities
HTML is a markup language, so a literal < in your text is ambiguous: the browser cannot tell a paragraph from a tag. This tool converts the reserved characters into character references when you encode, and turns references back into readable text when you decode — entirely in your browser.
Choose a direction. Pick Encode to make raw text safe inside HTML, or Decode to recover the original text from a document that already contains entities. For example, decoding <title> returns <title>, ready to be edited or analysed.
Paste the text. Drop a fragment, a template value or a whole line of markup into the input box. Encoding Tom & Jerry produces Tom & Jerry, because the ampersand becomes harmless to the parser.
Pick the escaping level (encode). Leave “only the five critical characters” switched on for modern UTF-8 pages, where Café & Co. becomes Café & Co. Switch it off to also convert every non-ASCII character to a numeric reference — Café & Co. then becomes Café & Co. — which is useful for legacy or ASCII-only channels.
Run the conversion and read the stats. The tool reports the input length, the output length and how many references it created or resolved, so you can immediately spot a fragment whose size changed unexpectedly.
Copy the result. The copy button places the output on the clipboard; paste it into an HTML file, a CMS field, an email template or a JavaScript template literal.
Verify by decoding. Paste the encoded output back in Decode mode: <a href="/x"> returns <a href="/x">, which confirms that the round-trip is lossless.
What Is HTML Entity Encoding?
HTML treats certain characters as syntax. A < opens a tag, a > closes it, an & begins a character reference, and a quote delimits an attribute value. When you insert ordinary text that happens to contain those characters, the parser may read it as markup: a comment containing <b> suddenly renders bold, and a stray & can swallow the following word or break the page. Escaping replaces each reserved character with a character reference — a short, unambiguous code such as < for < — so the browser renders the original character instead of interpreting it. There are two families of references. Named references use a memorable word, such as &, © or , while numeric references give the code point in decimal (&) or hexadecimal (&). Both write the same character; the numeric form works even for characters that the specification never named, such as most emoji. The five characters that must always be escaped in text are & , < , > , " and ' . The two quotes matter mainly inside attribute values, but escaping them everywhere is a safe and predictable default. Escaping is also a first line of defence against cross-site scripting (XSS). If untrusted input such as <script>alert(1)</script> is written into a page without escaping, the browser executes it. Escaping the angle brackets turns that same input into visible text. Escaping is not a complete security strategy, however: sanitising rich HTML requires a context-aware library, and escaping for one context (an HTML body) is wrong for another (a URL query or a JavaScript string). For plain text placed into HTML, though, correct escaping is both necessary and sufficient. All conversions here run in native JavaScript on your own device. Nothing is sent to a server, which matters when the text contains credentials, personal data or unreleased content.
Common Applications
1. User-generated content: a comment that reads “I <3 this product” must appear literally. Escaping the angle bracket yields “I <3 this product”, so the browser shows the text instead of starting a tag.
2. Code examples and tutorials: to display <div class="box"> inside a lesson you write <div class="box">, and decoding it again gives you the clean snippet to copy.
3. Attribute values: a product title containing a double quote, such as Widget 12" Deluxe, breaks title="Widget 12" Deluxe"; encoding the quote to " keeps the attribute intact and the markup valid.
4. Legacy and ASCII-only channels: some email clients, SMS gateways and older content-management systems handle only ASCII, so Café, € and → are converted to numeric references such as Café, € and → while staying readable.
5. Cleaning scraped or CMS content: a description stored as Grüße aus München is unreadable to code; decoding returns Grüße aus München for analysis, translation or a word count.
Named, Decimal and Hexadecimal Character References
Every character can be written three ways. The letter A is simply A, its code point is U+0041, and its references are A (decimal) and A (hexadecimal). A handful of characters also have memorable names: & for &, < for <, " for " , ' for ' and for a non-breaking space. Named references are readable in source code; numeric references always work, even for characters the specification never named.
This tool emits &, <, >, " and ' when it encodes. The apostrophe is written as ' rather than ' because ' is not recognised in the older HTML4 specification and ' is accepted everywhere. When decoding, it recognises the common named entities, decimal references such as é for é, and hexadecimal references such as é for the same character. An ampersand followed by something that is not a valid reference is left untouched, so ordinary text is never mangled.
Common Mistakes to Avoid
The first trap is double-encoding. If you encode Tom & Jerry a second time you get Tom &amp; Jerry, which renders as the literal text Tom & Jerry. Always encode raw text, never text that is already escaped. If you are unsure, paste the value in Decode mode first to see what the browser would display.
The second trap is double-decoding. Decoding &lt; once correctly yields <; decoding it a second time yields < and destroys information that should have stayed visible. This tool performs a single left-to-right pass, so each reference is resolved exactly once and an entity it has just produced is never re-interpreted.
The third trap is confusing escaping with sanitising. Escaping makes reserved characters visible, but it does not remove scripts from HTML that you intend to render as rich markup. For that you need a dedicated sanitiser with a strict allow-list. Finally, remember context: the escaping that is right for an HTML body is wrong for a URL query string or a JSON value.
Escaping vs URL-Encoding vs Sanitising
Three transformations are often confused. HTML escaping converts the characters that are special to an HTML parser — & , < , > , " and ' — into character references, and that is what this tool does. Percent-encoding, also called URL encoding and produced by encodeURIComponent, replaces characters that are not permitted or that carry structural meaning in a URL with %XX sequences: a space becomes %20 and & becomes %26.
Sanitising has a different goal altogether. It parses untrusted HTML and removes dangerous elements, attributes and protocols while keeping a safe subset of markup, so a rich-text editor can accept bold and links but strip scripts and event handlers. Use HTML escaping for plain text shown in a page, percent-encoding for URLs and query strings, and a vetted sanitiser when you must accept rich HTML from users. Choosing the wrong one is a common source of both broken pages and security bugs.
Related Utilities
- JSON Formatter & Validator — Free JSON Beautifier
- Base64 Encoder & Decoder — Online Converter
- Password Generator — Strong Random Passwords
- URL Encoder & Decoder — Free Percent-Encoding Tool
- UUID Generator — Generate Random UUID v4 Online
- Remove Duplicate Lines — Online Line Remover
Guides
Frequently Asked Questions - FAQ
Does escaping an ampersand twice break my page?
Yes, avoid it. An ampersand becomes & once; encoding that result again gives &amp;, which the browser displays literally as &. Encode the original text, not text that is already escaped. Decoding here is a single pass, so it never re-interprets a reference it has just produced.
Which characters must be escaped in HTML?
The five critical characters are & , < , > , " and '. The ampersand and the angle brackets are essential in text, while the double quote and the apostrophe matter most inside attribute values. Escaping all five everywhere is the safe default this tool recommends.
What is the difference between ' and '?
They are the same apostrophe. ' is the decimal code point 39, and ' is the same value written in hexadecimal (0x27). Both are accepted by every browser; the named form ' is only valid in HTML5, which is why this tool prefers '.
Is my text uploaded anywhere?
No. The entire conversion runs locally in your browser with native JavaScript. Your input is never uploaded, logged or stored on any server, so it is safe to use with sensitive content.
Does this tool make my website safe from XSS?
It helps, but it is not a complete solution. For plain text inserted into an HTML body, escaping the five critical characters is the correct treatment. If you must render rich HTML from users, use a dedicated sanitiser with an allow-list instead, because escaping for one context is wrong for another.
Last updated: