HTML Entity Encoder / Decoder
Escape or unescape HTML entities — &, <, numeric and named — in one click. Runs locally, nothing uploaded.
Escape or unescape HTML entities — &, <, quotes, and numeric or named entities — in one click. Paste text to make it safe for embedding in HTML, or paste encoded snippets to read them back. Everything runs locally in your browser.
How to use the HTML Entity Encoder / Decoder
- Paste the text you want to escape (or encoded text to decode).
- Choose Encode or Decode — optionally encode all non-ASCII characters.
- Copy the result into your HTML, email template or CMS.
Frequently asked questions
How do I escape HTML in text?
Paste the text and click Encode — &, <, > and quotes become &amp;, &lt;, &gt; and &quot;, so it renders safely inside HTML.
How do I decode HTML entities?
Paste the encoded text and click Decode. Named entities (like &copy;) and numeric ones (like &#169;) are converted back to characters.
What does 'Encode all non-ASCII' do?
It converts every character above code point 127 to a numeric entity, so your text survives in encodings or contexts that only support ASCII.
Is my text uploaded anywhere?
No — encoding and decoding happen entirely in your browser.
Fun facts about HTML Entity Encoder
- HTML entities start with & and end with ; — for example, & represents the ampersand character (&).
- The five 'essential' HTML entities are & (&), < (<), > (>), " ("), and ' (') — these must be escaped in HTML to prevent parsing errors.
- Numeric character references can use decimal (€) or hexadecimal (€) notation — both represent the euro sign (€).
- Symbols like ♥ (♥) and ♠ (♠) were already named entities in HTML 4; HTML5 expanded the list to more than 2,000 named character references.
- XSS attacks often use HTML entities to bypass filters — for example, javascript:alert(1) decodes to javascript:alert(1) in an href attribute.