HTML Encoder / Decoder
Encode and decode HTML entities and special characters
One escape per context
The right escaping depends on where the string lands:
- Element text needs < & > entities; quoted attribute values additionally need quotes escaped.
- Inside a URL or a JavaScript string, HTML entities are wrong twice over — they double-encode and can even reintroduce injection holes.
- This tool keeps the contexts separate so a value safe for an attribute does not silently get reused inside script.
Half-escaped is worse than not escaped
Both directions, both styles
Encode or decode in one click, with name-style (&) and numeric-style (&) output both available — whatever your target format wants.
Beyond the five essentials
Optionally encode every non-ASCII character to guarantee font-proof, ASCII-only output that renders identically in any email or legacy system.
Private in your browser
The entire encode/decode runs locally — ideal for license keys, personal data and any text you do not want sent to a server.
Frequently asked questions
Why do I need HTML encoding?
In HTML, "<" starts a tag and "&" starts an entity. If you insert user content without escaping, a quote or bracket can break the layout or even enable injection attacks. Encoding neutralizes those characters so the text shows literally.
Named vs numeric references?
Named references like & are readable but cover only the common set; numeric references like & (or hex &) work for every Unicode code point. Use numeric when you need universal encoding of non-ASCII text.
Is my text uploaded anywhere?
No. Everything runs in your browser with plain JavaScript — nothing you paste is transmitted or stored.
Related tools
What is an HTML encoder / decoder?
When text is dropped into a web page, a handful of characters stop being innocent content: an opening angle bracket starts a tag, an ampersand starts an entity, and quotes can break out of attributes, mangling layout or opening injection holes. HTML encoding replaces those characters with entity references so browsers display the text exactly as written instead of parsing it as markup. This tool encodes the five significant characters into named or numeric references, optionally converts every non-ASCII character as well, and decodes named plus decimal and hex numeric references back to readable text.
Why five characters need disguises
- Encode the five markup-significant characters to named references, or to decimal numeric references with one switch
- Optional full conversion that turns every character above basic ASCII into a numeric reference
- Decode a wide named set matched without regard to letter case, covering symbols, punctuation, arrows, math and card suits
- Decode decimal and hex numeric references, leaving out-of-range points untouched
- Report byte size of input versus output, with sample text, copy and plain-text download
Cleanup tasks it simplifies
- Neutralizing user input before injecting it into templates, CMS content or HTML email
- Reading entity-clogged strings from feeds, scrapes and logs back into plain language
- Seeing exactly what a browser sees when it parses an ambiguous snippet
What encoding does and does not fix
Encoding is output hygiene, not a security boundary on its own: it stops markup interpretation at the point of insertion but cannot repair broken page structure elsewhere, and decoding untrusted entities can reintroduce live characters, so decode only text you intend to handle as text. Empty input is refused outright, and unknown named references pass through unchanged rather than being guessed. Attribute, URL and script contexts need their own escaping rules.
Privacy: encoding and decoding run wholly in-page; pasted snippets, keys and secrets stay on your computer and are never transmitted.
Last updated · 2026-09-01