Encode text to HTML entities or decode entities back to text.
Processed locally — your text is never uploaded.
How do you encode and decode HTML entities?
Encoding replaces the reserved characters &, less-than, greater-than, double quote and apostrophe with their entity equivalents; decoding resolves named entities such as © and numeric ones such as © or ©. Entities let you show characters that would otherwise be read as markup. Encoding a bold tag around “Tom & Jerry” turns the brackets and ampersand into <, > and &.
Understanding your result
Entities let you show characters that would otherwise be interpreted as markup, and protect against broken layouts when displaying user content.
Formula and method
Encoding replaces the reserved characters &, less-than, greater-than, double quote and apostrophe with their entity equivalents. Decoding resolves named entities such as © and numeric entities such as © or ©.
Assumptions and limitations
Encoding escapes the reserved characters ampersand, angle brackets, double quote, and apostrophe so they render as text; decoding resolves named and numeric entities. This makes content display safely but is not a complete security measure — proper protection against cross-site scripting also depends on the correct context and framework escaping where the value is used.
Worked example
Encoding a bold tag around “Tom & Jerry” turns the angle brackets and ampersand into <, > and &.
How to use this tool
- Choose Encode or Decode.
- Paste your text or HTML.
- Copy the converted output.
Common mistakes to avoid
- Encoding text twice, which turns & into a double-escaped entity.
About the HTML Entity Encoder / Decoder
Convert reserved and special characters to HTML entities so they display correctly, or decode entities back to plain text. Everything runs in your browser.
Who should use this tool
Web developers displaying reserved characters like angle brackets or ampersands as visible text, content authors escaping user-submitted input, and anyone decoding a string full of entities back into readable characters. Especially handy when showing code samples on a page without the browser interpreting them as markup.
Benefits
- Escapes reserved characters so they display as text
- Decodes named and numeric entities back to characters
- Prevents user content from breaking your page layout
- Encodes and decodes entirely in your browser
Practical use cases
- Showing HTML code samples as visible text on a page
- Escaping user input before displaying it
- Decoding an entity-encoded string from a feed
- Displaying an ampersand or angle bracket literally
Explore all Developer Tools tools
Frequently asked questions
Does this prevent XSS?
Encoding output before inserting it into HTML is one important defence, but always escape on the server too and use a strict templating layer.
Are numeric entities supported?
Yes. Decoding handles decimal and hexadecimal numeric entities as well as common named entities.
Are numeric HTML entities like © supported?
Yes. The decoder resolves both named entities such as © and numeric entities. Numeric entities can be written in decimal, like ©, or hexadecimal, like ©, and both forms produce the same character, in this case the copyright symbol. All three notations decode to the correct character.
Does encoding HTML entities fully protect against XSS?
Encoding reserved characters prevents user content from being interpreted as markup, which stops many injection attacks in HTML body context. However, complete protection depends on escaping correctly for each context, such as attributes, URLs, or scripts. Treat entity encoding as one important layer, not a total XSS solution on its own.