Free HTML entity encoder / decoder

What is an HTML entity encoder (and what this tool does)

An HTML entity encoder rewrites the handful of characters that have a special meaning in HTML so a browser shows them as plain text instead of treating them as markup. The characters <, > and & are how HTML starts tags and references; left raw inside your content, the browser tries to parse them and your page breaks. This HTML entity encoder / decoder does the translation both ways: the encode side escapes those reserved characters into safe entities, and the decode side turns entities back into the literal characters they stand for.

An entity is just an escape sequence: a name or number wrapped in & and ; that the browser swaps for one character when it renders the page. Writing < in your source displays a literal < on screen, with no risk of it being read as the start of a tag. The tool above runs this conversion live as you type — paste text or markup on the left, pick encode or decode, and read the result on the right.

Why you need to escape reserved characters

HTML reserves a small set of characters to build the document itself. A < opens a tag, a > closes one, and an & begins an entity reference. When the browser meets one of these, it assumes you mean the markup, not the literal symbol. So the moment your content contains one of them — a maths expression with 5 < 10, a company name like Tom & Jerry, a code sample full of tags — the browser misreads it.

• Broken rendering. Text like a < b can swallow everything after the < as if it were an unfinished tag, so part of your page simply vanishes.
• Corrupted output. An & followed by letters and a semicolon — R&D; — may be read as an entity and silently changed.
• Injection (XSS). If untrusted text containing <script> reaches the page unescaped, the browser runs it as code rather than printing it. Escaping turns that tag into harmless visible text.

Escaping resolves all three at once. Replace each reserved character with its entity and the browser prints the symbol you meant — 5 < 10 shows 5 < 10 — instead of trying to parse it. The HTML standard defines these reserved characters and the references that stand in for them.

Named vs numeric HTML entities

Every character reference comes in two forms, and they are interchangeable. A named entity uses a human-readable keyword — & for the ampersand, < for the less-than sign. A numeric entity uses the character's Unicode code point instead: &#NN; in decimal, or &#xHH; in hexadecimal. The letter A (code point 65, hex 41) can be written as A or A, and both render an identical A.

• Named entities are readable but limited — only characters the HTML spec has named (a fixed list of around 2,000) can use them. © gives ©,   gives a non-breaking space.
• Numeric entities work for any Unicode character, named or not, so they are the universal fallback. The decimal © and hex © both produce © with no name required.
• The apostrophe is the classic split. ' was only added to the named list in HTML5, so this tool encodes a single quote as the numeric ' — which every browser, including old ones, understands.

The reserved characters and their HTML entities

These are the characters that must be escaped in HTML content, with the named and numeric references that replace them. The encode side of this tool handles the first five — &, <, >, " and ' — which is the set that actually breaks parsing or enables injection. The rows below them are common non-reserved entities you will meet when reading HTML.

Named references and code points per the HTML Living Standard named-character-reference list. This tool escapes & < > " ' on encode; the other rows are reference entities you may encounter when decoding.

A worked example: encoding a link

Step 1 — Find the reserved characters

Scan the string for the five that need escaping. It contains two angle-bracket pairs (the opening <a> and the closing </a>), the two double quotes around example.com, and one ampersand in Click & go. There is no apostrophe here, so the ' rule never fires.

Step 2 — Replace each one with its entity

Each < becomes <, each > becomes >, each " becomes ", and the & becomes &. Every other character — the letters, the slash, the dot, the spaces — is left untouched.

Step 3 — Read the encoded result

The output is <a href="example.com">Click & go</a>. Dropped into a page, that renders on screen as the literal text <a href="example.com">Click & go</a> — visible markup, not a working link. The decode side reverses it exactly.

Encode vs decode: which side do you need?

The mode switch decides the direction. Encode goes from raw characters to entities — use it when you are writing content into an HTML page and need reserved characters to survive as text. Decode goes from entities back to characters — use it when you are reading HTML that someone has already escaped and want the original back.

• Encode when you are embedding a code sample in a blog post, putting user-supplied text into a template, or pasting a value into a CMS field that renders as HTML. Anything with <, > or & needs it.
• Decode when you have copied escaped HTML out of page source, an email template, or a database, and want to see the human-readable original — turning & back into &.
• Round-trip safely: encode then decode returns the exact input. The two operations are inverses, so you can move text in and out of HTML without losing or altering a character.

Real use-cases for entity encoding

Entity encoding shows up anywhere text crosses into an HTML context and has to keep its literal meaning. The common thread is the same in every case: the content contains a character the browser would otherwise read as structure.

• Showing code in HTML. Tutorials, documentation and forums that display markup must encode it, or the examples would render as live elements instead of printed code.
• CMS and template content. Titles or body text with an ampersand or angle bracket — Q&A, <3 — need escaping before they are written into a page so the CMS does not mangle them.
• HTML emails. Email clients parse HTML strictly; an unescaped & or quote in a subject line or body can break the layout, so generated emails escape dynamic values.
• Inserting user input. Comments, usernames and form data that get echoed back into a page must be encoded — both to display correctly and to block injection.

Entity encoding as an XSS defense — and its limits

Escaping untrusted input before it lands in a page is one of the core defenses against cross-site scripting (XSS). If an attacker submits <script>steal()</script> and your page outputs it raw, the browser runs that script. Encode it first and the same input becomes <script>steal()</script> — harmless text the browser displays rather than executes. That single step neutralises the most common injection path.

So treat HTML entity encoding as necessary for the HTML body and attribute context, not as a complete XSS solution by itself. The standard guidance is to encode on output, encode for the exact context, and pair it with other controls. Most modern frameworks — React, Vue, Angular — entity-encode text bindings automatically, which is why their default rendering is safe; the danger returns the moment you bypass that with a raw-HTML escape hatch.

Does this encoder send my text anywhere?

No. The encoding and decoding run entirely in your browser with plain string replacement. The text you paste is never stored, logged, or sent to any server — there is no network request, because none is needed — so the tool works the same offline and your content stays on your device.

Because it only rewrites characters, entity encoding is not a security control for your data and should never be confused with encryption: the output is fully readable and reverses instantly. For other transport-safe formats, see the URL encoder / decoder, which percent-encodes text for web addresses, and the Base64 encoder / decoder for binary-safe text.

HTML entity definitions

How reliable is this HTML entity encoder?

Calculators that work alongside the HTML entity encoder / decoder

These pair naturally with this one for decisions that sit nearby.

Frequently asked questions about the free HTML entity encoder / decoder

About this HTML entity encoder / decoder

This HTML entity encoder / decoder runs entirely in your browser. The text you paste is never stored, logged, or sent to any server — the escaping is computed locally with plain string replacement, so it works the same offline. Encode escapes the reserved characters & < > " ' for safe HTML output; decode turns named and numeric entity references back into the characters they stand for. It only changes how characters are written; it is not encryption and hides nothing.

Looking for more developer utilities? Try the URL encoder or the Base64 encoder, or browse the rest of our dev tools.