HTML Encoder / Decoder
Escape text into HTML entities or decode named and numeric entities back to plain text — with the browser's own parser doing the decoding.
How to use this tool
- Choose Encode to escape text for safe inclusion in HTML, or Decode to turn entities back into characters.
- Paste your text — the result updates live.
How it works
Encoding escapes the five HTML-significant characters — & < > " ' — into their entities, which prevents user text from being interpreted as markup. Decoding uses the browser's own HTML parser, so it handles every named entity (©, —, …) and numeric form (©, —) that browsers do.
Entity-escaping is output encoding for HTML contexts specifically — URLs need percent-encoding and JavaScript strings need JSON escaping instead.
Frequently asked questions
Which characters must be escaped in HTML?
At minimum & < and > in content, plus " and ' inside attribute values. This tool escapes all five.
Why does decoded text look different from the rendered page?
Whitespace — HTML collapses runs of spaces and newlines when rendering. The decoded text preserves them exactly.
Is this enough to prevent XSS?
Entity-encoding untrusted text before inserting it into HTML content is the core defense for that context — but attributes, URLs, CSS, and script contexts each need their own encoding. Use a templating engine or sanitizer for anything complex.