BUY WEBSITES
BUY DOMAINS
LOGIN
SIGNUP
HTML Entity Encoder / Decoder
An HTML entity encoder and decoder converts characters that have special meaning in markup into safe entity codes and turns those codes back into readable text. The ampersand, angle brackets, and quotes can break a page or open an injection hole when they land in HTML raw, so encoding them to &, <, and > is the difference between content that renders and content that silently corrupts the surrounding markup.
This tool encodes text to entities and decodes entities back to characters in two clicks, with an option to escape only the five markup-critical characters or every non-ASCII code point as numeric entities. It is free and runs entirely in your browser, so pasted snippets, draft copy, and structured-data fragments never leave the page.
🔒 Private: everything runs in your browser. Nothing you paste is uploaded.
How to use the HTML entity encoder and decoder
Pick the Encode or Decode tab, paste your text, and the result updates as you type. Encoding offers a special-characters-only mode for safe HTML embedding and an all-non-ASCII mode for maximum portability; decoding resolves named and numeric entities alike.
Encode special characters only for clean HTML embedding
The special-characters-only mode escapes just the five that matter for markup safety: the ampersand, the less-than and greater-than signs, the double quote, and the single quote. This is the right choice when pasting copy, code samples, or user-supplied strings into an HTML page, because it neutralises the characters that could close a tag early or start an unintended entity while leaving accented letters and emoji as readable Unicode. The single quote is written as ' rather than ' because the numeric form is valid in every HTML version and email client.
Encode all non-ASCII characters for maximum portability
The all-non-ASCII mode converts every code point above 127, accented letters, currency symbols, dashes, and emoji, into numeric entities such as © for the copyright sign. This guarantees the text survives systems with broken or ambiguous character encoding, since the output is pure ASCII. Toggle hexadecimal output to emit © instead, the form often seen in XML and older feeds. Astral characters like emoji are emitted as a single entity from their true code point, not as a pair of broken surrogate values.
Decode entities back to text safely, without executing anything
The decode tab resolves named entities like © and numeric entities in both decimal (©) and hexadecimal (©) form, using the browser’s complete built-in entity table rather than a partial lookup list. Decoding is done by reading the value of a detached textarea element, which resolves the codes but never parses or runs the input as live HTML, so a pasted <script> fragment stays inert text. Tokens that are not real entities are reported and passed through unchanged rather than mangled.
HTML entity encoder and decoder frequently asked questions
Q1Which characters does HTML entity encoding actually require?
Five characters carry special meaning in HTML and should be encoded when placed in markup: the ampersand, the less-than sign, the greater-than sign, the double quote, and the single quote. The ampersand and angle brackets matter in element content, while the quotes matter inside attribute values. The special-only mode encodes exactly these, which is enough for safe embedding in nearly all cases.
Q2What is the difference between named and numeric entities?
A named entity uses a memorable word, like the copyright symbol written as the ampersand plus copy plus a semicolon. A numeric entity uses the character’s code point, in decimal as ampersand-hash-169 or in hexadecimal as ampersand-hash-x-A9. Numeric entities work for every Unicode character, while named ones exist only for a fixed set, so numeric forms are the more portable choice for unusual symbols.
Q3Is it safe to decode untrusted HTML with this tool?
Yes. Decoding reads the value of a detached textarea element, which resolves entity codes into characters but never parses the input as live HTML and never executes scripts. A pasted script fragment is returned as inert text, not run. Because the entire process happens locally in your browser, nothing you paste is uploaded, logged, or stored anywhere.
Q4Why is the single quote encoded as a number instead of a name?
The single quote is encoded as ampersand-hash-39 rather than the named ampersand-apos form because the numeric version is valid in every version of HTML and is reliably supported by email clients and older parsers. The named apostrophe entity was only standardised in HTML5 and can fail to render in some legacy contexts, so the numeric form is the safer default.
Q5Does encoding emoji or accented letters change how they look?
No. An encoded entity is just an alternative spelling of the same character, so a browser renders ampersand-hash-169 and the literal copyright symbol identically. Encoding only changes the underlying bytes, which helps text survive systems with unreliable character encoding. Decoding the entities later returns the exact original characters, including multi-byte emoji, with no visual difference once rendered.
