HTML Entity Encoder / Decoder Developer Tool

Encode text to HTML entities or decode entities back to plain text.

Dropping a raw ampersand, angle bracket, or quote into HTML markup can break the page or open an injection hole, and text copied from elsewhere often carries exactly those characters. This free HTML entity encoder is a developer tool that converts text to safely-escaped named and numeric entities, and decodes entities back to plain text, entirely in your browser.

Plain text

Entities

Use numeric entities (&) instead of named entities (&) when encoding

Runs entirely in your browser — no data is sent anywhere.

Named vs. numeric entities

A named entity like & or © is easier to read in raw markup, but only a fixed set of characters have a standardised name. A numeric entity — decimal (©) or hexadecimal (©) — can represent any Unicode code point, which is why it's the fallback for anything outside the small set of common named entities. This tool encodes the five characters with reserved meaning in HTML (&, <, >, ", ') as named entities by default, or as numeric entities if you tick the numeric option, and decoding understands both forms plus the wider table of common named entities browsers recognise.

Why these five characters matter

< and > open and close HTML tags, so an unescaped one in user-supplied text can be interpreted as markup rather than displayed literally — the same mechanism behind most reflected XSS. & is escaped because it begins entity references themselves, so a literal ampersand needs escaping to avoid being misread as the start of one. " and ' matter specifically inside attribute values, where an unescaped quote can terminate the attribute early and let following text be parsed as new attributes or markup.

Where this differs from URL or JSON escaping

HTML entity escaping only matters when text is being placed into HTML markup — a page template, an innerHTML assignment, an XML document. It's a different concern from URL encoding, which escapes characters that have special meaning inside a URL, and from JSON string escaping (covered by the string escape tool), which protects characters that would break out of a JSON string literal. Applying the wrong one — say, URL-encoding text destined for HTML — doesn't protect against anything and usually just corrupts the output.

Rendering Markdown or user content safely

Any tool that turns arbitrary text into rendered HTML — including this site's own Markdown previewer — has to escape the raw input the same way this tool does before applying any further transformation, otherwise a stray <script> tag in the source text would execute rather than display. If you're building something similar, encode first, transform second.