HTML Entity Encoder / Decoder
Encode or decode HTML entities.
Encode or decode HTML entities.
Related tools
Ready tools are shown first.
Tool guide
Free Online HTML Entity Encoder / Decoder
Encode HTML-sensitive characters as entities or decode supported named and numeric HTML entities into plain text. Use it to display markup examples and inspect entity-encoded content without rendering the result as HTML.
Steps
How it works
- Choose Encode or Decode.
- Paste text, paste entity-encoded content, or choose one text or HTML file.
- Convert the supported special characters or entities.
- Review, copy, or download the plain-text result.
Highlights
Key features
- Encodes ampersands, angle brackets, double quotes, apostrophes, and non-breaking spaces.
- Uses named entities for &, <, >, double quotes, and non-breaking spaces, plus ' for apostrophes.
- Decodes supported named entities and decimal or hexadecimal numeric character references.
- Leaves unknown named entities unchanged instead of guessing.
- Displays output as plain text rather than executing markup.
- Provides text/HTML file input, copy, and text download actions.
Use cases
Common uses
- Show an HTML snippet as readable text in documentation.
- Decode copied entity text for inspection or editing.
- Escape common reserved characters in a basic HTML text example.
- Convert numeric character references into visible Unicode characters.
Notes
Limitations to know
- Only a small set of named entities is decoded; the full HTML named-entity catalog is not included.
- Entity encoding is not context-aware HTML sanitization and does not by itself prevent XSS.
- HTML text, attribute, URL, JavaScript, and CSS contexts require different security rules.
- Encoding already encoded text can double-encode its ampersands.
- Malformed or unsupported entities may remain unchanged or fail if they contain an invalid numeric code point.
FAQ
Frequently asked questions
Which characters does HTML Entity Encoder escape?
It encodes &, <, >, double quotes, apostrophes, and non-breaking spaces.
Does it use named or numeric entities?
Encoding uses common named entities and ' for apostrophes. Decoding also recognizes decimal and hexadecimal numeric entities.
Is HTML entity encoding the same as sanitization?
No. This text conversion is not a context-aware HTML sanitizer or a complete XSS defense.
What happens if I encode text twice?
Ampersands in existing entities are encoded again, so text such as & can become &amp;.
Are all named HTML entities supported?
No. Common names are supported, while unknown named entities remain unchanged.
Does decoded HTML execute?
No. The converted output is presented as plain text in this tool.