HTML Entity Encode / Decode
Escape & < > " ' for safe HTML, and decode entities back to text — instantly.
Type text on the left to escape it for HTML.
¿Qué es HTML Entity Encode / Decode?
HTML entity encoding replaces characters that have special meaning in HTML markup — namely the ampersand, less-than, greater-than, double quote, and apostrophe — with equivalent entity references such as < and &. This prevents the browser from interpreting those characters as part of a tag or attribute boundary, which is essential whenever you need to display raw code samples, user input, or arbitrary text inside an HTML document without triggering markup parsing or cross-site scripting. Encoding maps & to &, < to <, > to >, " to ", and ' to '. This tool performs both directions: it escapes those five characters for safe inline display, and it reverses the encoding by decoding the core named entities, a set of common typographic names, and both decimal (') and hexadecimal (') numeric entities. Unknown references are passed through untouched rather than dropped, so existing markup you did not mean to touch is preserved.
Cómo usar HTML Entity Encode / Decode
- Pick Encode to escape text, or Decode to turn entities back into characters.
- Type or paste your content on the left; the converted result appears live on the right.
- Use Copy output to grab the result, or Use output as input to round-trip the text back through the opposite direction.
Ejemplos
Escape a tag
Entrada: <a href="x">Tom & Jerry</a>
Salida: <a href="x">Tom & Jerry</a>
Decode entities
Entrada: 5 < 10 && 10 > 5
Salida: 5 < 10 && 10 > 5
Apostrophe
Entrada: It's
Salida: It's
Errores comunes
- Escaping only < and > but forgetting the ampersand — & must be escaped first, otherwise an existing entity like & can be turned into &amp; on a second pass.
- Using ' for the apostrophe; it is not recognised by legacy HTML parsers and can break attribute values in older browsers.
- Relying on HTML entity encoding as a complete XSS defence inside <script> or href attributes — those contexts need additional, context-specific escaping.
- Decoding a string that mixes entities with literal markup you wanted to keep, and ending up with a live tag where you only meant to display text.
Por qué usar esta herramienta
- Escapes exactly the five characters the HTML specification treats as special, with the ampersand first to avoid double-escaping.
- Decoder handles numeric (decimal and hex) entities plus a useful set of named entities, and leaves unknown references intact.
- Round-trip with one click via Use output as input, which is handy when iterating on encoded payloads.
- Runs entirely in the browser — no data leaves the page, which matters for code samples and credentials.