HTML Entity Encoder & Decoder

Five characters have structural meaning in HTML — less than, greater than, ampersand, and both quote marks — and any of them appearing literally in content can break the page or open an injection hole. This tool escapes them to named entities and decodes entities back to readable text.

How to use it

1. Paste the text or markup you want to convert.
2. Press Encode to escape the special characters, or Decode to reverse it.
3. Choose whether to escape non-ASCII characters as numeric entities too.
4. Copy the safe output into your template.

Frequently asked questions

Which characters must always be escaped?

& becomes &amp;, < becomes &lt;, > becomes &gt;, " becomes &quot;, and ' becomes &#39;. Escaping the ampersand first matters, otherwise you double-escape everything else.

Do I still need entities if the page is UTF-8?

For accented letters and emoji, no — UTF-8 handles them directly. The five structural characters must still be escaped regardless of encoding.

Does escaping prevent XSS?

Context-appropriate escaping is the core defence, but the correct escaping differs inside HTML text, an attribute, a URL, and a script block. Use your framework’s contextual escaping rather than one blanket pass.

What is a non-breaking space?

&nbsp; renders as a space that never wraps to a new line. Useful between a number and its unit, but strings of them used for layout indentation are a sign the CSS needs attention.

All free tools · Blog · About · Contact

Also available in: Español · Português · Français · Deutsch