What is HTML entity encoding?

HTML entity encoding replaces characters that have special meaning in HTML — like the less-than sign, greater-than sign, ampersand and quotes — with safe escape sequences such as < and &. This lets the characters display as literal text instead of being interpreted as markup.

Why do I need to encode HTML entities?

Encoding prevents two problems: broken layouts, where a stray angle bracket is mistaken for a tag, and security holes, where unescaped user input can inject scripts. Displaying code samples, user comments, or any text containing markup characters safely requires entity encoding.

What is the difference between named and numeric entities?

Named entities use readable names like © for the copyright symbol, while numeric entities use a character code like ©. Numeric entities work for any character regardless of a named equivalent, which is why the tool offers a numeric mode for non-ASCII characters.

Does the decoder handle all entity types?

Yes. The decoder converts named entities, decimal numeric entities and hexadecimal numeric entities back into their original characters, so you can reverse any properly-encoded HTML text.

Is this tool safe for sensitive text?

Yes. All encoding and decoding happens locally in your browser, so nothing you paste is uploaded or stored. It is safe for private code, internal content and confidential strings.

Which characters must always be encoded in HTML?

The five critical characters are the ampersand (&), less-than (<), greater-than (>), double quote (") and single quote ('). Encoding these reliably prevents both display errors and injection vulnerabilities in most contexts.

HTML Entity Encoder / Decoder

Remove Ads

HTML Entity Encoder and Decoder — Escape and Unescape Text Safely

Certain characters carry special meaning in HTML, and using them literally breaks pages or opens security holes. This free tool converts those characters into safe HTML entities — and converts entities back into readable text — instantly and privately in your browser. Whether you are displaying a code sample without it rendering as markup, sanitizing user input, or simply decoding an entity-laden string you received, it handles both directions with named and numeric entities, no signup required and nothing ever uploaded.

What HTML Entities Are and Why They Exist

HTML uses a handful of characters as structural signals. The less-than and greater-than signs delimit tags, the ampersand begins an entity, and quotes delimit attribute values. The moment one of these appears in your actual content — say you want to write "5 < 10" or show a snippet of code — the browser tries to interpret it as markup, and your page breaks or displays incorrectly. HTML entities solve this by providing escape sequences: < renders as a literal less-than sign, & renders as a literal ampersand, and so on. The browser shows the intended character without ever treating it as code.

The Five Characters You Must Always Encode

Character	Named entity	Why it matters
&	&	Begins every entity; must be escaped first
<	<	Opens tags; unescaped it breaks layout or injects markup
>	>	Closes tags; escaped for correctness and safety
"	"	Delimits attributes; must be escaped inside attribute values
'	'	Also delimits attributes; escaped to prevent breakouts

Encoding these five reliably prevents the overwhelming majority of display bugs and a major class of security issues. This tool always escapes them correctly, and escapes the ampersand first so you never end up with double-encoded output.

Encoding for Security: Preventing XSS

Beyond cosmetics, entity encoding is a frontline defense against cross-site scripting (XSS), one of the most common web vulnerabilities. When an application takes text from a user — a comment, a username, a search term — and places it into a page without escaping, an attacker can embed a script tag that then runs in other visitors' browsers. Encoding the dangerous characters neutralizes this: the injected angle brackets become harmless literal text rather than a live tag. While a complete security strategy involves context-aware escaping and other layers, converting untrusted content's special characters to entities is a fundamental and essential habit, and this tool makes it easy to see exactly what safe output looks like.

Named Versus Numeric Entities

Entities come in two flavors. Named entities are human-readable — © for ©,   for a non-breaking space, € for €. They are easy to recognize but only exist for a defined set of characters. Numeric entities reference a character by its code point, in decimal (©) or hexadecimal (©), and can represent any character, including emoji and symbols that have no named form. This tool's optional numeric mode encodes every non-ASCII character as a numeric entity, which is invaluable when you need maximum compatibility across systems that might not handle raw Unicode consistently.

Common Real-World Uses

Displaying code samples: encode a snippet so tags and brackets show as text instead of rendering, essential for tutorials and documentation.
Sanitizing user input: encode comments, form submissions and profile fields before displaying them to block injection.
Fixing garbled text: decode a string full of & and ' sequences back into clean, readable content.
Email and template safety: ensure special characters survive intact across systems that interpret HTML.
Preparing data for attributes: encode quotes so values sit safely inside HTML attributes without breaking out.

Decoding: Reversing the Process

Just as often, you need to go the other way — turning entity-encoded text back into plain characters. Maybe you copied content from a source that over-encoded it, or you are debugging output and want to read what a string actually says. The decoder here handles named entities, decimal numeric entities and hexadecimal numeric entities alike, reconstructing the original text faithfully. This two-way capability makes the tool useful throughout a development workflow, from preparing safe output to inspecting and cleaning up encoded data.

Private, Accurate, and Free

Every conversion runs locally in your browser, so your code and content never leave your device — safe even for proprietary or sensitive material. There is no account, no cost, and no limit on how much you convert. Correct entity handling is a small thing that prevents a surprising number of bugs and vulnerabilities, and having a reliable, instant encoder and decoder at hand makes it effortless to do the right thing. Explore our other developer tools for formatting, converting and generating the pieces of a robust web project.