HTML Entity Encoder & Decoder
Encode text into HTML entities or decode entities back into readable characters. Encoding is what lets you display markup as text on a page instead of having the browser execute it, and decoding turns an escaped string you were handed back into something you can read.
How it works
- 1
Pick a direction: encode plain text into entities, or decode entities back into characters.
- 2
Paste the text or the escaped string.
- 3
Read the converted output, updated as you type.
- 4
Copy the result into your template, documentation or data file.
What people use it for
- Displaying example HTML on a page as visible code rather than rendered markup.
- Escaping a snippet before pasting it into a CMS field that renders HTML.
- Reading an escaped string that came out of a log, an API response or an export.
- Preparing code examples for documentation or a tutorial.
Supported formats & options
| Encode | Converts markup-significant characters (such as < > & " ') into their HTML entity form |
|---|---|
| Decode | Converts named and numeric HTML entities back into the characters they represent |
| Input | Any text or HTML fragment pasted into the box |
Key advantages & benefits
Both directions
Encode for display and decode for reading, in the same tool.
Correct handling of the characters that matter
The characters that break markup — angle brackets, ampersands and quotes — are the ones the converter targets.
Fast iteration
Output updates as you type, so you can check a single character or a whole block equally quickly.
Runs locally
Snippets you paste, including template fragments, stay on your device.
Limits & things to know
- Entity encoding makes text safe to display; it is not a security boundary on its own. Server-side output escaping in the correct context (HTML, attribute, JavaScript, URL) is what actually prevents injection.
- Decoding an untrusted string produces markup that could be dangerous if you then insert it into a page as HTML. Decode for reading, not for direct rendering.
- Non-ASCII characters are generally safe to leave as-is in a UTF-8 document; encoding all of them makes the source harder to read for no benefit.
Troubleshooting
The encoded snippet still renders as markup
The destination is decoding entities before inserting them, which some rich-text editors do. Paste into a plain-text or code field, or wrap the snippet in a code element that the editor leaves alone.
Decoding leaves stray ampersand sequences
The string was probably double-encoded (&lt; rather than <). Run decode a second time on the result.
Privacy & data handling
Conversion is a text transformation performed in your browser. Nothing you paste is transmitted or stored.
HTML Entity Encoder & Decoder Online
Encode text into HTML entities or decode entities back into readable characters. A free HTML entity converter for escaping angle brackets, ampersands and quotes so user-supplied content renders as text instead of breaking your markup or opening an injection hole.
- Encode HTML special characters — convert angle brackets, ampersands and quotes into their safe entity equivalents so code snippets display literally inside a page.
- Decode HTML entities back to text — clean up scraped content, CMS exports and email templates where entities have been double-escaped into unreadable noise.
- Prevent broken markup and XSS — escaping untrusted strings before they are written into a template is the simplest defence against injected markup.
- Unicode and symbol support — handles accented characters, currency symbols, dashes and emoji alongside the standard reserved characters.
- Local, instant conversion — runs in your browser with no upload, so customer-submitted content stays private.
Free and unlimited. Use the Base64 Converter for binary-safe encoding, and the Markdown Preview when you are embedding escaped code samples in documentation.
Frequently asked questions
What characters get encoded?
Special HTML characters like <, >, &, ", ', and extended Unicode symbols.
When do I actually need to encode entities?
When you want markup to be displayed as text rather than rendered — code examples in documentation, or a snippet pasted into a field that renders HTML. Ordinary prose in a UTF-8 page does not need encoding.
Does encoding protect against XSS?
Not on its own. Correct, context-aware output escaping on the server is what prevents injection. Entity encoding here is for display, and should not be treated as a security control.
Why does decoding leave &lt; behind?
The string was double-encoded. Run decode a second time on the result to get back to the original characters.
Related tools
JSON Formatter
Format, validate and minify JSON instantly
Base64 Encoder & Decoder
Encode text or images to Base64 and decode back
Text Case Converter
Switch between UPPER, lower, Title & camelCase
URL Slug Generator & Sanitizer
Convert blog titles and text into clean URL slugs