HTML Entity Encoder & Decoder

HTML entity encoder & decoder

Escape text for safe placement inside HTML — &, <, >, " and the apostrophe become their entity equivalents — or decode named and numeric entities back into plain text. Escaping is the core defence against breaking your page layout or introducing cross-site scripting when you display user-supplied text.

Why escaping matters

When you insert raw user input into HTML without escaping, a value like <script>alert(1)</script> executes as markup rather than displaying as text. Even something as simple as a username containing " can close an attribute prematurely and corrupt the page. HTML escaping converts those dangerous characters into inert display sequences that the browser renders as text, never as code.

How it works

In encode mode the tool replaces each HTML-significant character with its entity:

• & → & (must be done first to avoid double-encoding)
• < → <
• > → >
• " → "
• ' → ' (numeric form, safer than ' which is undefined in HTML 4)

An optional setting additionally converts every non-ASCII character (accents, symbols, emoji) into a decimal &#NNN; numeric entity, producing pure-ASCII output for maximum email client and legacy system compatibility.

In decode mode it reverses the process, resolving named entities, decimal numeric references (é), and hexadecimal numeric references (é) — done through a parser that never injects your input into the live DOM, so untrusted markup cannot execute even while being decoded.

When to use each mode

Worked example

Encoding <a href="x">Tom & Jerry</a> gives:

<a href="x">Tom & Jerry</a>

Notice & is encoded as & before the other characters are replaced, preventing < from being re-encoded to <.

Decoding © 2026 — café gives © 2026 — café.

Quick reference table

Everything runs in your browser — nothing is uploaded. Pair it with the URL encoder for query strings.