HTML Entity Encoder / Decoder
Convert HTML to its escaped entity form or decode entities back to readable markup.
When text contains characters that a browser interprets as markup, the result is broken pages and broken output - and worse, an opening to injection attacks. HTML encoding replaces those characters with entity references that display correctly but carry no meaning to the parser. This tool escapes HTML in one direction and decodes entities back in the other.
The escape direction converts the five characters that matter in HTML and XML - ampersand, less-than, greater-than, double quote and single quote - into their named or numeric entities. The decode direction resolves those entities back into the characters they represent, including numeric references such as © for the copyright symbol.
All processing happens locally in your browser. Paste in a snippet of untrusted content and escape it before embedding, or paste in encoded markup and decode it to inspect the real structure. Nothing is uploaded, and the result belongs entirely to your session.
Features
- Escape HTML, XML and text for safe display in any page.
- Decode named entities like & and numeric references like ©.
- Handles the five core XML entities plus a broad set of common named entities.
- Round-trips accented characters, punctuation and symbols.
- Clear error-free handling of ambiguous input.
- Runs offline - no uploads, no logs, no server round trip.
How to Use
- 1
Paste the content
Enter raw HTML to escape, or an entity-encoded string to decode. Either direction starts from the same input box.
- 2
Choose the direction
Pick Escape to turn <p> into <p>, or Unescape to turn entity references back into real characters.
- 3
Run the conversion
Press the button and inspect the result. Escaped output renders as text in a page rather than executing as markup.
- 4
Use the result
Copy the escaped value into a template, a JSON payload or an email body, or download it for larger blocks.
Example
Raw HTML to entities
<a href="#">Click & Save</a>↓
<a href="#">Click & Save</a>Entities to text
café & © 2026↓
café & © 2026Common Problems
Escaping only angle brackets
Leaving ampersands and quotes unescaped still lets content break attributes and inject entities. A safe escape covers all five core characters, which is what this tool does.
Double-escaping content
Encoding a string that is already encoded escapes the ampersands of existing entities, producing &amp;. Escape exactly once at the point where untrusted content is inserted into the page.
Using a regex that breaks on edge cases
Hand-rolled escapes often miss entities, mishandle numeric references or choke on mixed content. A table-driven decoder resolves every known entity and leaves unknown sequences untouched.
Assuming escaping stops all attacks
Escaping neutralizes markup injection in HTML contexts, but the same content can still be dangerous in a URL or a script context. Choose the encoding that matches where the data will render.
Forgetting to decode before editing
Editing encoded markup by hand is error-prone. Decode it first, make the change, then escape again - the round trip keeps the entity layer consistent with what you actually see.
Decoding text that only looks like an entity
A literal string like "AT&T" decoded once becomes "AT&T". Decode it again and the ampersand is re-interpreted, doubling the layer. Entities stack, so decode exactly once at the boundary where you need the real text.
Technical Details
Escaping maps the five XML-sensitive characters to entities: &, <, >, " and the apostrophe. The apostrophe uses the numeric form ' because the named ' is not supported in classic HTML.
Decoding resolves named entities from the HTML standard set - &, <, >, ", plus common typographic and currency entities - and also resolves numeric references in both decimal (©) and hexadecimal (©) form.
Characters outside the sensitive five pass through unchanged, so escaping is non-destructive: decoding the escaped form returns the original input exactly.
Conversion happens entirely in the browser, so the tool works offline and never sees the content you process.
Because decoding is table-driven rather than guessed from context, the result for any well-formed input is deterministic. Unknown or ambiguous sequences are returned untouched, which keeps the output honest instead of silently corrupting it.
Entities exist because early pages had to stay ASCII-compatible. Today they are mostly used for the five markup-sensitive characters and for punctuation a keyboard cannot produce easily, which is why a decoder that knows the common set covers almost every real document.
Frequently Asked Questions
Why do I need to escape HTML?
So that user-provided text renders as text instead of being interpreted as markup. Escaped content displays the literal characters and cannot inject elements or run scripts when placed into a page.
What is the difference between & and &?
Both represent the ampersand. Named entities are easier to read, numeric references are more exhaustive - every character has a numeric form while only some have names. The decoder accepts both.
Does escaping also encode JavaScript?
No. Escaping applies to HTML contexts. JavaScript and URL contexts need their own encodings, and mixing them can create new holes. Match the escape to the output context.
Is my data sent to a server?
Never. The escape and decode operations run locally in your browser tab. The input is not uploaded, stored or logged.
Can I decode any entity, including rare ones?
The decoder handles the common named set and every numeric reference. A rarely used named entity that is not in the table is left as written rather than guessed, so nothing is silently mangled.
Should I escape quotes in plain text content?
Only when the content will sit inside an attribute value delimited by quotes. In body text, escaping them is harmless but unnecessary. Escaping all five characters consistently is simpler to reason about than deciding per position.
What characters does HTML escaping actually cover?
The five that change meaning in markup: & < > " and the apostrophe. Everything else is legal as-is and passes through, so escaping stays minimal and reversible rather than turning into a full transliteration.
Can I use this tool to prepare an email body?
Yes. Escaping the same five characters keeps plain-text and simple HTML email from being misread by the client, though multipart emails apply their own transport encoding on top.
Data & Privacy
Your data stays in your browser. Nothing is uploaded.
- Processing
- Local
- Upload
- None
- Server Storage
- None
- Account
- Not required
Related Tools
Base64 Encode & Decode
Convert text to Base64 or decode it back, with an optional URL-safe mode - all in your browser.
Encoding & Conversion
URL Encoder / Decoder
Percent-encode text for safe use in URLs and query strings, or decode it back to readable form.
Encoding & Conversion
Unicode Converter
Escape text as \uXXXX sequences or decode them back to readable characters, for JSON, JavaScript and Java.
Encoding & Conversion
Hex Converter
Convert text to hex bytes and back, revealing the UTF-8 representation of any string.
Encoding & Conversion
Binary Converter
Convert text to its 8-bit binary form and decode binary strings back to readable text.
Encoding & Conversion
URL Parser
Break any URL into protocol, host, path, query parameters and fragment for easy inspection.
Encoding & Conversion