HTML Entity Encoder / Decoder

What Are HTML Entities?

HTML entities are special codes used to represent characters that would otherwise have a reserved meaning in HTML, or that are difficult to type directly. Because the browser interprets characters like < and > as the start and end of tags, you cannot place them literally inside your content — doing so would break the page or, worse, allow injected markup to execute. Encoding them as entities such as < and > tells the browser to display the literal character instead of treating it as code.

Entities come in two flavours. Named entities use a human-readable shorthand wrapped in an ampersand and semicolon, such as & for an ampersand, © for the copyright symbol, or — for an em dash. Numeric entities use the character's Unicode code point, written as © (decimal) for the same copyright symbol. Both produce identical output when rendered; named entities are easier to read in source code, while numeric entities work for any character even when no friendly name exists.

How to Use This HTML Entity Encoder & Decoder

Paste your text or HTML into the Input box on the left. Click Encode to convert special characters into entities, or Decode to turn existing entities back into their plain characters. The result appears in the read-only Output box on the right, where you can use the Copy Output button to copy it to your clipboard. The Clear button empties both boxes.

Two checkboxes control how encoding behaves. By default, the encoder converts only the characters that need escaping for valid, safe HTML: &, <, >, ", and the apostrophe. Tick Encode all characters to also convert every non-ASCII character (code point above 127) into a numeric entity, which is useful when a system can only handle plain ASCII. Leave Use named entities when available checked to produce readable names like ©; uncheck it to force numeric entities for the five reserved characters instead.

Real-World Use Cases

• Displaying code in a web page — encode a snippet so that tags like <div> show as text instead of being rendered by the browser.
• Preventing cross-site scripting (XSS) — escape user-submitted content before inserting it into a page so injected markup cannot execute.
• Cleaning up pasted content — decode entities that crept into copied text or database fields back into normal, readable characters.
• Email and newsletter HTML — convert smart quotes, dashes, and symbols to entities for maximum compatibility across older email clients.
• ASCII-only environments — encode all characters so accented letters and symbols survive systems that only accept 7-bit ASCII.

Tips for Working With HTML Entities

• Always encode the ampersand first when doing it by hand; this tool handles ordering for you so a single & never becomes a double-encoded &.
• For escaping untrusted user input, the default mode (special characters only) is what you want — encoding all characters is unnecessary for safety and bloats the output.
• The decoder relies on the browser's own parser, so it understands far more named entities than the encoder produces, including ones the encoder leaves as plain text.
• If your output looks wrong after decoding, check that the input actually contained valid entities ending in a semicolon — malformed entities are passed through unchanged.
• Turn off named entities when a target system expects strictly numeric references, such as certain XML or legacy CMS pipelines.

Features

• Encode and decode — convert characters to entities and entities back to characters in one tool.
• Named entity support — emits friendly names like ©, —, and € for common symbols when enabled.
• Encode-all mode — optionally converts every non-ASCII character to a numeric entity for ASCII-only output.
• Browser-native decoding — uses the browser's HTML parser to reliably decode the full range of named and numeric entities.
• One-click copy and clear — copy the output to your clipboard or reset both boxes instantly.
• 100% client-side — your data never leaves your browser.

Frequently Asked Questions

Which characters does the encoder convert by default?

By default it converts only the five characters that are reserved or unsafe in HTML: the ampersand &, less-than <, greater-than >, double quote ", and the single quote or apostrophe. Everything else is left as-is unless you enable the "Encode all characters" option.

What is the difference between named and numeric entities?

Named entities use readable shorthand such as ©, while numeric entities use the character's code point such as ©. They render identically in the browser; named entities are easier to read in source, and numeric entities work for every character even when no name exists.

Will encoding all characters make my page bigger?

Yes. Enabling "Encode all characters" converts every non-ASCII character into a numeric entity, which is several characters long, so the output is larger. Use it only when a target system requires plain ASCII; for normal HTML safety the default mode is sufficient.

Does decoding handle entities the encoder doesn't produce?

Yes. The decoder uses the browser's built-in HTML parser, so it recognizes the full standard set of named and numeric entities — far more than the encoder emits. Any entity your browser understands will decode correctly.

Is this tool safe to use for escaping user input against XSS?

Encoding the reserved HTML characters is a core part of preventing cross-site scripting, and this tool does that correctly. However, proper XSS defence depends on context (HTML body, attribute, URL, script); for production code you should escape on the server or framework layer rather than pasting input through a web tool.

Is my data sent anywhere?

No. All encoding and decoding happens entirely in your browser using JavaScript. Nothing you type is uploaded, logged, or stored, and the tool continues to work even if you go offline after loading the page.