HTML Entity Encoder & Decoder
Encode HTML special characters to entities or decode entities back to plain text. 100% client-side — your data never leaves your browser.
0 chars
0 chars
About HTML Entity Encoder & Decoder
HTML uses special characters like <, >, &, ", and ' for its own syntax. If you want to display these characters as text on a webpage — for example, showing a code snippet or user-generated content — you must replace them with HTML entities (also called character references). HTML entities are sequences like < (for <), > (for >), & (for &), " (for "), and ' (for '). This tool encodes any text to its safe entity form, or decodes existing HTML entities back to readable text. Encoding is essential for preventing XSS (cross-site scripting), safely displaying code, and handling user input on websites.
How It Works
- Paste or type your text (containing HTML special characters) in the input box.
- Click "Encode to Entities" to convert <, >, &, ", ' into their safe HTML entity forms.
- Click "Decode from Entities" to convert HTML entities back to their original characters.
- The result appears instantly — copy it with one click.
✨ Key Features
- ✓Encode HTML special characters to entities
- ✓Decode HTML entities back to plain text
- ✓Handles named entities (&, <, ©) and numeric entities (©, ©)
- ✓Supports all standard HTML entity references
- ✓Preserves Unicode characters and emoji
- ✓One-click copy for output
- ✓100% client-side — no data sent to any server
- ✓No signup, no limits, completely free
🎯 Common Use Cases
- →Safely displaying code snippets on a webpage
- →Sanitizing user-generated content to prevent XSS attacks
- →Encoding HTML emails and templates
- →Preparing text for XML or RSS feeds
- →Debugging HTML output that shows raw tags instead of rendering
- →Converting CMS content between raw HTML and entity-encoded form
- →Preparing text for inline SVG or MathML
💡 Advanced Tips & Pro Insights
- ▸Only 5 characters MUST be encoded inside HTML text: <, >, &, ", '. The & character must be encoded first, otherwise you might double-encode other entities.
- ▸Named entities like & or © are easier for humans to read, while numeric entities like © or © work in any context including XML.
- ▸Modern HTML5 supports over 2000 named entities. This tool covers the standard set used in everyday development.
- ▸Encoding does NOT prevent XSS by itself — malicious code can still be embedded in attributes or javascript: URLs. Use a proper sanitizer for untrusted input.
- ▸For maximum safety in text content, only < > & need encoding. In attributes, quotes (both " and ') must also be encoded.
Frequently Asked Questions
Is this HTML entity encoder free?▾
Yes, this HTML entity encoder and decoder is completely free with no signup, registration, or usage limits.
Is my data safe?▾
Yes, 100% safe. All encoding and decoding happens in your browser. Your data never leaves your device.
What are HTML entities?▾
HTML entities (also called character references) are codes used to represent special characters in HTML. For example, < represents <, > represents >, & represents &, and © represents ©. They are essential for safely displaying characters that would otherwise be interpreted as HTML syntax.
Which characters should I encode?▾
The five characters that MUST be encoded in HTML text or attributes are: < (as <), > (as >), & (as &), " (as "), and ' (as '). The ampersand must be encoded first to avoid double-encoding other entities.
What is the difference between named and numeric entities?▾
Named entities use letter codes (&, ©, ™) and are human-readable. Numeric entities use decimal (©) or hexadecimal (©) codes and work in any context including XML. Both produce the same character when rendered.
Does HTML encoding prevent XSS attacks?▾
Encoding helps but is not sufficient alone. XSS can also occur through unquoted attributes, javascript: URLs, and event handlers. For untrusted input, use a dedicated HTML sanitizer like DOMPurify in addition to encoding.
Does this tool handle Unicode and emoji?▾
Yes, Unicode characters, emoji, and multi-byte characters pass through unchanged. Only HTML special characters are encoded.
Can I decode entities from an old webpage?▾
Yes, paste the entity-encoded text and click "Decode from Entities" to see the original characters. Both named and numeric entities are decoded correctly.