Skip to content
DevTools

HTML Entity Encoder & Decoder

Escape special characters as HTML entities (< > & ") or decode named and numeric entities back to text. Optionally encode all non-ASCII characters.

Input

Output

Ready

Runs locally in your browser — your data is never uploaded.

About the HTML Entity Encoder

Escape text for safe inclusion in HTML by converting &, <, >, " and ' to entities — the basic defence against breaking markup and against HTML injection when you display user content. Optionally convert every non-ASCII character to a numeric entity for systems that only accept ASCII.

Decoding handles named entities (&amp;copy;, &amp;mdash;, &amp;nbsp;…), decimal (&amp;#169;) and hexadecimal (&amp;#xA9;) references.

How to use it

  1. Choose Encode or Decode.
  2. Paste HTML or text.
  3. Copy the result.

Features

  • Escapes the five HTML-significant characters
  • Optional non-ASCII encoding
  • Decodes named, decimal and hex entities

Frequently asked questions

Does escaping protect against XSS?

Escaping is essential when inserting text into HTML element content and quoted attributes, but contexts such as URLs, JavaScript and CSS need different encoding. Use your framework's auto-escaping where possible.

Is my data uploaded anywhere?

No. All processing happens in JavaScript inside your browser tab. Your input is never sent to a server, logged or stored, so it is safe to use with internal or sensitive data.