HTML Entity Encoder / Decoder
Encode or decode HTML special characters
About HTML Entity Encoder / Decoder
The HTML entity converter encodes special characters so they display literally in HTML, and decodes entities back to plain text. Encoding replaces exactly five characters: & becomes &, < becomes <, > becomes >, a double quote becomes ", and a single quote becomes '. That is enough to place text safely inside element content or a quoted attribute. Every other character, including accented letters, symbols and emoji, is left as it is. Encoding is not idempotent: running it on text that already contains & produces &amp;. Decoding uses the browser's own HTML parser on a hidden text field, so it understands all named entities the browser knows, such as © and …, as well as decimal and hex numeric references like © and 😀. Any literal < in your input is escaped before parsing, so pasted tags are never interpreted as markup and decode mode cannot execute scripts. Decoding is a single pass: &lt; becomes <, not <. For example, Tom & Jerry's encodes to Tom & Jerry's. Input is limited to 500,000 characters. This is formatting only, not a sanitiser, so it does not make untrusted HTML safe to insert.
How to use HTML Entity Encoder / Decoder
- Choose Text → HTML entities or HTML entities → text from the Mode menu.
- Paste your text or markup into the Your input box.
- Check the converted text in the Result box.
- Press Copy result or Download to use it.
Frequently Asked Questions
Five: ampersand, less-than, greater-than, double quote and single quote. Letters, digits, accented characters and emoji are not converted to numeric entities.
Yes. Decoding relies on the browser's HTML parser, so named entities and decimal or hex numeric references are all turned back into their characters.
Decoding runs once. The & is turned into &, leaving the text lt; after it. To fully unwrap a double-encoded string, run the decode mode a second time on the result.
It escapes the characters that matter in element text and quoted attributes, but it is not a full sanitiser. Use your framework's escaping or a vetted sanitiser for untrusted input, and never in script contexts.
Yes. Each ampersand is encoded again, so < becomes &lt;. Decode first if you are unsure whether the text was already encoded.