HTML Entity Encode / Decode
Escape & < > " ' for safe HTML, and decode entities back to text — instantly.
Type text on the left to escape it for HTML.
What is HTML Entity Encode / Decode?
HTML entity encoding replaces characters that have special meaning in HTML markup — namely the ampersand, less-than, greater-than, double quote, and apostrophe — with equivalent entity references such as < and &. This prevents the browser from interpreting those characters as part of a tag or attribute boundary, which is essential whenever you need to display raw code samples, user input, or arbitrary text inside an HTML document without triggering markup parsing or cross-site scripting. Encoding maps & to &, < to <, > to >, " to ", and ' to '. This tool performs both directions: it escapes those five characters for safe inline display, and it reverses the encoding by decoding the core named entities, a set of common typographic names, and both decimal (') and hexadecimal (') numeric entities. Unknown references are passed through untouched rather than dropped, so existing markup you did not mean to touch is preserved.
How to Use HTML Entity Encode / Decode
- Pick Encode to escape text, or Decode to turn entities back into characters.
- Type or paste your content on the left; the converted result appears live on the right.
- Use Copy output to grab the result, or Use output as input to round-trip the text back through the opposite direction.
Examples
Escape a tag
Input: <a href="x">Tom & Jerry</a>
Output: <a href="x">Tom & Jerry</a>
Decode entities
Input: 5 < 10 && 10 > 5
Output: 5 < 10 && 10 > 5
Apostrophe
Input: It's
Output: It's
Common Mistakes
- Escaping only < and > but forgetting the ampersand — & must be escaped first, otherwise an existing entity like & can be turned into &amp; on a second pass.
- Using ' for the apostrophe; it is not recognised by legacy HTML parsers and can break attribute values in older browsers.
- Relying on HTML entity encoding as a complete XSS defence inside <script> or href attributes — those contexts need additional, context-specific escaping.
- Decoding a string that mixes entities with literal markup you wanted to keep, and ending up with a live tag where you only meant to display text.
Why Use This Tool
- Escapes exactly the five characters the HTML specification treats as special, with the ampersand first to avoid double-escaping.
- Decoder handles numeric (decimal and hex) entities plus a useful set of named entities, and leaves unknown references intact.
- Round-trip with one click via Use output as input, which is handy when iterating on encoded payloads.
- Runs entirely in the browser — no data leaves the page, which matters for code samples and credentials.