HTML Entity Encoder / Decoder
FREE TOOL · NO SIGN-UP
This HTML entity encoder decoder converts special characters into HTML entities and turns entities back into readable text. Paste your text, choose encode or decode, and pick named, decimal or hex entities to get output that’s safe to drop into HTML. It’s useful for developers escaping user content, writers showing code in blog posts and anyone fixing text full of & and '.
What HTML Entities Are and Why They Exist
An HTML entity is a short code that stands for a character. It starts with an ampersand and ends with a semicolon, like < for < or © for ©. Browsers replace the code with the character when they display the page.
Reserved characters
A few characters have special meaning in HTML. < and > open and close tags, & starts an entity, and " and ' wrap attribute values. If you want them to appear as text, you need to escape them, otherwise the browser may treat them as markup. Writing 5 < 10 in raw HTML can confuse the parser, while 5 < 10 always displays correctly.
Entities were also historically used for characters that were hard to type or couldn’t be represented in a page’s character set. With UTF-8 now standard, most symbols can be used directly, but entities are still handy for invisible characters like the non-breaking space.
Named vs numeric entities
Named entities use a memorable word: &, <, >, ", , ©. They’re easy to read but only exist for a defined list of characters. Numeric entities use the character’s Unicode code point, either in decimal (&) or hexadecimal (&). They work for every character, including emoji, so they’re the safe fallback when no name exists.
How to Encode or Decode HTML Entities
The result updates live as you type or change a setting.
Step 1 – Paste text
Paste your text or HTML into the Input text box. It can be a code snippet, a paragraph with symbols or a string full of entities you want to read.
Step 2 – Choose encode or decode
Pick a Mode. Encode converts only the five reserved characters: &, <, >, " and '. Encode everything non-ASCII also converts accented letters, symbols, emoji and non-breaking spaces. Decode does the reverse and turns named, decimal and hex entities back into characters.
Step 3 – Pick named or numeric
Choose an Entity style. Named uses names where they’re available (&, <, >, ", , ©, ®, ™, €, £) and falls back to numeric codes for everything else, including the apostrophe, which becomes '. Decimal and Hex use numeric codes for every converted character.
Step 4 – Copy result
Click Copy to grab the output or Download to save it as a text file. The stats show input and output character counts, so you can see how much longer encoding made the text.
HTML Encoding and XSS
Cross-site scripting (XSS) happens when untrusted input, such as a comment or a search query, is placed into a page without escaping, and the browser runs it as code. Encoding is one of the main defences.
Context-aware escaping
The correct escaping depends on where the data goes. Inside normal HTML text, escaping <, > and & stops new tags from being created. Inside an attribute value, quotes must be escaped too, so the value can’t break out of its quotes. Inside a <script> block, a URL or CSS, HTML entity encoding isn’t the right tool at all: those contexts need JavaScript, URL or CSS escaping. Modern templating engines and frameworks escape for the context automatically, which is the safest approach.
Why encoding alone isn’t enough
Encoding output protects one spot in one context. Real XSS protection also includes validating input, using framework escaping consistently, avoiding unsafe functions that insert raw HTML, and adding a Content Security Policy as a second layer. Use this tool for understanding, testing and one-off content, not as a replacement for secure code.
HTML vs URL vs JavaScript Encoding
Picking the right one
These encodings look similar but do different jobs. HTML encoding makes characters safe to display in a page (& becomes &). URL encoding, or percent-encoding, makes characters safe inside a web address (a space becomes %20). JavaScript or JSON escaping makes characters safe inside a string literal (a quote becomes \"). For strings in code, use our JSON / String Escape & Unescape tool.
Double-encoding problems
If text is encoded twice, entities show up on the page literally. & becomes &, and a second pass turns it into &amp;, so visitors see & instead of &. This often happens when content passes through several plugins or systems that each escape it. The fix is to encode once, at the point of output.
Useful Entities for Writers
Symbols and spaces
A few entities are worth remembering: keeps two words on the same line, such as 10 kg; ©, ® and ™ give ©, ® and ™; and — and – produce long and short dashes. In a modern UTF-8 site you can type most symbols directly, but entities are useful when an editor or system strips them.
Showing code in posts
To show HTML code as text in a blog post, every < and & must be encoded, or the browser will render the tags instead of displaying them. Paste the snippet, use Encode mode and paste the result inside a code or preformatted block. In WordPress, the Code block handles basic escaping, but encoding manually is reliable for custom HTML blocks.
Encoding Mistakes
Double-encoded ampersands
If you see &amp; or &quot; on a live page, something encoded already-encoded text. Decode once, then find which step in your workflow adds the extra layer.
Encoding whole documents
Running a full HTML document through Encode turns every tag into text, so the page shows raw code. Only encode the text content you want displayed literally.
Mojibake from wrong charset
Garbled characters like “é” instead of “é” are a character-set mismatch, not an entity problem. Make sure the page declares UTF-8 and the file is saved as UTF-8.
Display Any Character Safely
Encoding the right characters at the right time keeps pages displaying correctly and closes off simple security holes. Use the HTML entity encoder decoder for snippets, symbols and broken entities, then escape strings for code with JSON / String Escape & Unescape, hide email addresses from scrapers with the Email Obfuscator and pull plain text out of markup with the HTML to Text Converter. There’s more in the FHSEO Hub free SEO tools collection.