HTML Entity Encoder & Decoder

What are HTML entities?

HTML uses certain characters with special meaning — < starts a tag, > closes one, & begins an entity, " and ' delimit attribute values. To use those characters literally inside HTML content (rather than as syntax), you have to "escape" them: replace each special character with a named or numeric entity. The browser then displays the character but doesn't treat it as code.

The five core HTML entities everyone needs:

Character	Named entity	Numeric entity
<	&lt;	&#60;
>	&gt;	&#62;
&	&amp;	&#38;
"	&quot;	&#34;
'	&#39;	&#39;

When you'll need this

• Pasting code samples into blog posts — every < in your code becomes part of the HTML unless escaped.
• Email templates with literal & in URLs or text.
• JSON-LD structured data where strings contain HTML metacharacters.
• User-submitted comments and reviews — escaping prevents stored XSS attacks.
• RSS / Atom feed bodies that include HTML content.
• Markdown documentation showing HTML syntax examples.
• API responses that return HTML or HTML-fragment strings.

Encode-all mode

Standard encoding only escapes the five HTML-unsafe characters. The "Encode ALL non-ASCII" option additionally encodes every character above ASCII (accents, emojis, CJK, etc.) as numeric entities. Useful for legacy systems that only support 7-bit ASCII text, or for ensuring an HTML file works without explicit character encoding declarations.

Security note: XSS

Properly escaping HTML entities is one of the foundational defences against cross-site scripting (XSS) attacks. Any user-supplied content that ends up inside HTML must be escaped — otherwise an attacker could inject <script> tags that execute in another user's browser. Always escape user input on output, not on input (escape when displaying, not when storing).

This tool is a manual encoder — for production code, use your framework's built-in escaping (React's JSX, Vue's mustache syntax, Django/Jinja autoescape, etc.) rather than doing it by hand.

Decoding

Use Decode mode to convert HTML entities back to plain characters. Useful when reading API responses, log files or database dumps that contain escaped HTML.

FAQs

Related encoder tools