HTML Entity Encoder & Decoder Online - Free HTML Escape Tool

Features

Named entities

Numeric entities

Quick reference table

How to Use

1. Pick Encode or Decode.

2. Paste your text into the input.

3. The result appears on the right — click Copy.

About this tool

In HTML, characters like <, > and & have special meaning, so showing them as text requires entities such as <, > and &. Encoding user-provided text this way is also one of the basic defences against cross-site scripting when inserting content into a page. This tool converts the five reserved characters — & < > " ' — and every non-ASCII character into entities: Named mode uses readable forms like é and © where they exist, and Numeric mode writes codes like é for everything. Decoding turns any named or numeric entity back into the real character. It is handy for preparing code samples for blog posts, fixing double-encoded text in a CMS, or reading escaped strings from an API response.

Frequently Asked Questions

Which characters must be encoded in HTML?

In text content, & and < must always be encoded, and > usually is for consistency. Inside attribute values, the quote character used to wrap the value (" or ') must also be encoded. Other characters can be written directly when the page uses UTF-8.

What is the difference between named and numeric entities?

Named entities use readable names such as © or €, but only exist for a defined list of characters. Numeric entities such as © or € can represent any Unicode character. Browsers treat both the same way.

Why do I see &amp; in my text?

The text has been encoded twice, so & was encoded again into &amp;. Decode it once or twice until the entities disappear, and make sure your application only escapes content at the final output step.

Is HTML encoding enough to prevent XSS?

It protects text placed inside HTML elements and quoted attributes. Content inserted into JavaScript, CSS, URLs or unquoted attributes needs context-specific escaping, so use your framework's templating functions rather than manual encoding.

Does decoding run any HTML or scripts?

No. Decoding converts entity text into characters using an inert method and shows the result as plain text, so tags in the input are not rendered and scripts are not executed.