HTML Encoder / Decoder

Encode special characters to HTML entities and back. Live output. Client-side.

HTML entities, both directions. Encode text into HTML entities, or decode entities back into text. All in your browser. How to use ↓·Shortcuts ↓
Text → HTML entities.
Style:
Samples:
Text Input
HTML Entities Output
Output will appear here.
Input: 0 chars · 0 bytesOutput: 0 chars · 0 bytes

How to use

Pick a direction with the tabs — Encode or Decode. Paste your input into the left pane. The output appears on the right as you type.

Encode mode always converts the five special characters (&, <, >, ", '). Turn on Encode non-ASCII to also convert characters above 127 — accented letters, symbols, currency signs — using your chosen style (named, decimal, or hex).

Decode mode handles every entity the browser knows: named (&copy;), decimal (&#169;), and hex (&#xA9;).

Back to top

Keyboard shortcuts

Three shortcuts:

Cmd / Ctrl + KFocus the input pane
Cmd / Ctrl + EnterCopy output to clipboard
Cmd / Ctrl + /Toggle between Encode and Decode
Back to top

When to use it

Encoding matters whenever text goes into an HTML page and the text contains characters HTML treats specially.

  • Displaying code snippets inside HTML without them being interpreted as markup.
  • Preventing XSS by escaping user input before rendering it.
  • Ensuring special characters like & in URLs or query strings render correctly.
  • Making non-ASCII content robust across systems with limited encoding support.

Decoding matters when you receive HTML-encoded content and need the original text back — from an API, a legacy database column, or a scraped page.

Back to top

Options

Encode non-ASCII (Encode mode) — when off, only the five special characters get encoded. When on, everything above ASCII 127 also gets converted to an entity.

Style (Encode mode, only when non-ASCII is on):

  • Named — uses readable names like &copy;, &euro;, &mdash; for common characters. Falls back to decimal for anything without a named entity.
  • Decimal — numeric like &#169;. Universal, always works.
  • Hex — numeric hex like &#xA9;. Common in generated markup.

Decode has no options — the browser's HTML parser handles every entity type.

Back to top

Format-specific gotchas

Only five chars are dangerous. For preventing HTML injection, encoding just &, <, >, ", and ' is enough. Encoding non-ASCII is a display/portability choice, not a security one.

Order of the basic 5 matters. Ampersand must be encoded first, otherwise you double-encode. This tool handles that.

Decoding uses the browser DOM. That means it accepts loose HTML too — an unterminated entity like &copy without the semicolon still decodes in many browsers. Result may vary by browser.

Emoji are supra-BMP. Modern browsers handle them fine as decimal or hex entities (&#128512;), but named entities don't exist for them.

Back to top

Privacy

Everything runs in your browser. Your text never leaves the page — no server, no logging, no analytics on the content.

Back to top

Frequently asked questions

What are HTML entities?
Special sequences that represent characters that either have meaning in HTML (like &lt; for <) or that are hard to type. They start with & and end with ;. Three forms: named (&copy;), decimal (&#169;), and hex (&#xA9;).
Do I need to encode non-ASCII characters?
Not for security — only the five basic characters matter for preventing HTML injection. Encoding non-ASCII is useful when your target system has limited encoding support, or when you want the source file to stay pure ASCII.
What is the difference between named, decimal, and hex entities?
Named entities are readable shortcuts (&copy; for ©). Decimal uses the codepoint (&#169;). Hex uses the hex codepoint (&#xA9;). All produce the same character. Named is easier to read, numeric is universal.
Does Decode handle every entity type?
Yes. Decoding uses the browser HTML parser, so any entity the browser knows — named, decimal, hex, obscure ones — decodes correctly.
Does the tool send my text anywhere?
No. All encoding and decoding happens in your browser. The input never leaves the page.
Will this protect me from XSS?
Encoding user input before injecting it into HTML is one XSS defense. But context matters — attribute values, JS strings, and URLs need context-specific escaping too. Use a battle-tested library for production XSS prevention.
Back to top