Free Online HTML Entity Encoder / Decoder
Escape and unescape HTML special characters safely.
Decoding is a single pass, so text such as &lt; becomes <
rather than being decoded twice. Unknown entities are left unchanged.
About the HTML Entity Encoder and Decoder
Some characters cannot appear literally in HTML, or would change the meaning of the markup if they did. The less-than sign starts a tag, the ampersand starts an entity, and quotes can terminate an attribute. HTML entities replace these characters with an unambiguous sequence. This tool encodes text into named or numeric entities and decodes entities back into readable text.
Named, decimal, and hexadecimal entities
- Named: readable references such as
&,<,>,", and'. Named forms are easier to read, but not every Unicode character has a name. - Decimal numeric: the Unicode code point written as
&. Works for any character. - Hexadecimal numeric: the same code point in base 16, such as
&. Common in JavaScript and CSS escape sequences.
The five characters that matter most in ordinary HTML text and attribute values are ampersand, less-than, greater-than, double quote, and single quote. Encoding all five is the safe default when inserting untrusted text into markup. If you also enable the non-ASCII option, accented letters, currency signs, arrows, and emoji are replaced with numeric references. This is useful for email templates and old systems that do not handle UTF-8 reliably, though modern pages usually keep UTF-8 text as-is and save bytes.
Decoding accepts named entities, decimal references, and hexadecimal references in one pass. That single pass
is important: if the input contains &lt;, the correct output is <,
not <. Anything that is not a recognised entity is preserved exactly, so malformed markup is
not damaged. Paste your text above and switch direction at any time; everything stays in your browser.
How to use this tool
- Paste text into the input box.
- Choose encode or decode, and pick an entity style when encoding.
- Enable non-ASCII encoding if you need pure ASCII output.
- Copy or download the result.
Frequently asked questions
Should I encode quotes in HTML text?
Quotes do not need encoding in text content, but encoding them is harmless and is required in some attribute contexts. Encoding all five special characters is the simplest safe rule.
Why does decoding not turn everything back at once?
Decoding runs a single pass specifically to avoid double-decoding. If a decoded result looks like another entity, run the decode step again only when you intentionally want nested decoding.
Does this tool sanitize HTML?
No. Entity encoding is not a substitute for a proper HTML sanitizer when you insert untrusted markup. It only escapes characters.