HTML Entity Encoder / Decoder
Switch between two modes in your browser.
Encoding text is not the same as sanitizing untrusted HTML. Decoded output is shown as plain text and is not executed.
Encode escapes only the five HTML-sensitive characters (& < > " ') and leaves all other Unicode untouched, so encoding text that already contains entities double-encodes it (& becomes &). Decode handles named, decimal, and hexadecimal HTML character references.
How to use it
- Choose a mode: Encode text to HTML entities, or Decode HTML entities back to characters
- Type or paste your text into the input box
- Click the Encode or Decode button to get the result
- Copy the result, or switch modes and Clear to start again
Encode escapes the five HTML-sensitive characters — & < > " ' — turning markup such as <a> into text that is safe to place inside HTML, while every other character, including accents, CJK, and emoji, is left exactly as typed. Decode does the reverse for HTML character references: named entities such as © and , decimal references such as ©, and hexadecimal references such as ©, all resolved to their real Unicode characters. Encoding treats the input as raw text, so a string that already contains & is double-encoded to &amp; — this is expected, not a bug. Unknown names and malformed numeric references are left as they are or handled with the browser's HTML rules, never guessed at. Everything runs locally; nothing is uploaded or stored. Decoded output is shown as plain text in a read-only box and is never rendered or executed, and encoding text is not a substitute for sanitizing untrusted HTML. This is different from a URL Encoder, which applies percent-encoding for links, and from a Base64 Encoder, which encodes bytes or text into an ASCII alphabet.
FAQ
Only the five characters that are significant in HTML markup: & becomes &, < becomes <, > becomes >, " becomes ", and ' becomes '. Every other character is left unchanged.
Yes. Decode mode resolves HTML5 named entities such as © and , decimal numeric references such as €, and hexadecimal references such as 😀, into their Unicode characters.
No. Escaping the five HTML characters is one useful building block, but it is not a substitute for sanitizing untrusted HTML. This tool does not validate, repair, or sanitize markup.
Encode treats its input as plain text, so an ampersand that is already part of an entity is escaped again. There is no reliable way to detect whether text is already encoded, so nothing is guessed.
No. Both encoding and decoding happen entirely in your browser. Nothing is sent to a server, nothing is written to storage, and the decoded result is shown as plain text, never executed.