HTML Entity Encoder / Decoder
HTML entities are special codes used to represent characters that have reserved meaning in HTML, such as angle brackets (< and >), the ampersand (&), quotation marks ("), and apostrophes ('). Encoding these characters ensures browsers render them as visible text instead of interpreting them as markup, which is essential for safely displaying user-generated content and code snippets on the web.
This tool performs two-way conversion: encoding transforms plain text into safe HTML by replacing reserved characters with their named or numeric entity equivalents (e.g. < becomes <), while decoding reverses the process and converts HTML entities back to readable text. It handles all five standard HTML escape characters as well as numeric entities in both decimal (A) and hexadecimal (A) form.
How it works
Encode: & → & | < → < | > → > | " → " | ' → '. Decode: browser-native textarea parsing, which resolves named entities, decimal (&#N;), and hex (&#xN;) forms.
Use cases
- Safely embedding user-generated content in HTML pages to prevent XSS injection
- Displaying source code or markup examples on a blog or documentation site
- Preparing text for use inside HTML attributes such as title, alt, or data-* fields
- Decoding obfuscated or encoded HTML snippets received from APIs or scraped pages
- Learning or teaching how browsers interpret HTML special characters and entities
Frequently asked questions
What is an HTML entity and when do I need one?
An HTML entity is a code like < or & that represents a character with special meaning in HTML. You need entities whenever you want a browser to display characters such as <, >, &, quotes, or apostrophes as visible text instead of interpreting them as markup. This is essential when showing code samples or any user-provided text on a web page.
What is the difference between named and numeric HTML entities?
Named entities use a mnemonic name, like < for the less-than sign, while numeric entities reference the character's Unicode code point in decimal (<) or hexadecimal (<) form. All three forms render identically in browsers. Named entities are easier to read, but numeric entities work for any Unicode character, even ones without a defined name.
Does encoding HTML entities prevent XSS attacks?
Encoding the five reserved characters (&, <, >, ", ') neutralizes the most common HTML injection vector, because injected tags and attributes are rendered as inert text. However, it is only safe for content placed in regular HTML element bodies or quoted attributes — contexts like JavaScript strings, URLs, or CSS need their own context-specific escaping. Treat entity encoding as one layer of defense, not a complete security strategy.
How do I decode &amp; back into a normal ampersand?
Paste the text into the decoder and it converts & back to &, along with any other named, decimal, or hexadecimal entities. Text that has been encoded twice — for example &amp;lt; — may need to be decoded twice to fully recover the original characters.
Do I need to encode accented characters like é or ñ?
Not anymore in most cases. Modern pages served with UTF-8 encoding can include accented and non-Latin characters directly in the HTML. Entities such as é remain useful when you cannot control the document's character encoding or when editing legacy systems that mangle non-ASCII bytes.