HTML Encoder / Decoder
Encode and decode HTML entities and special characters
One escape per context
The right escaping depends on where the string lands:
- Element text needs < & > entities; quoted attribute values additionally need quotes escaped.
- Inside a URL or a JavaScript string, HTML entities are wrong twice over — they double-encode and can even reintroduce injection holes.
- This tool keeps the contexts separate so a value safe for an attribute does not silently get reused inside script.
Half-escaped is worse than not escaped
Both directions, both styles
Encode or decode in one click, with name-style (&) and numeric-style (&) output both available — whatever your target format wants.
Beyond the five essentials
Optionally encode every non-ASCII character to guarantee font-proof, ASCII-only output that renders identically in any email or legacy system.
Private in your browser
The entire encode/decode runs locally — ideal for license keys, personal data and any text you do not want sent to a server.
Frequently asked questions
Why do I need HTML encoding?
In HTML, "<" starts a tag and "&" starts an entity. If you insert user content without escaping, a quote or bracket can break the layout or even enable injection attacks. Encoding neutralizes those characters so the text shows literally.
Named vs numeric references?
Named references like & are readable but cover only the common set; numeric references like & (or hex &) work for every Unicode code point. Use numeric when you need universal encoding of non-ASCII text.
Is my text uploaded anywhere?
No. Everything runs in your browser with plain JavaScript — nothing you paste is transmitted or stored.
Related tools
What is an HTML encoder / decoder?
When user input is inserted into a web page, the characters & < > are dangerous: "<" begins a tag, "&" begins an entity, and a stray character can break layout or enable injection. HTML encoding replaces those characters with their entity forms so the text displays exactly as written instead of being interpreted as markup. The reverse — decoding — turns entity strings back into readable characters, handy when reading an RSS feed, scraping a page, or debugging a tiny encoded string.
What it can do
- Encode & < > " ' and optionally all non-ASCII characters
- Decode named entities (amp, lt, gt, quot, apos, copy, nbsp and more)
- Decode decimal and hexadecimal numeric references (&, &)
- Switch between name-style and numeric-style entities in a click
- Completely client-side, so even license keys and secret text can be handled
- Report input and output sizes
When to use it
- Escaping user input before inserting it into HTML or a template
- Preparing content for a CMS or HTML email
- Decoding entity-encoded text from feeds or scraped sources
- Understanding what the browser sees when it parses a string
Privacy: the conversion happens entirely in your browser — nothing you paste is ever uploaded.