HTML Entity Encoder / Decoder

What are HTML Entities?

HTML entities are special codes that represent characters which would otherwise be interpreted as markup or cannot be typed directly. For instance, the less-than sign < is written as &lt; so the browser treats it as a literal character rather than the start of a tag. The most important entities are &amp; (&), &lt; (<), &gt; (>), &quot; ("), and &#39; (').

Our HTML Entity Encoder / Decoder converts these special characters into entities so your text displays correctly inside HTML, and decodes entities back into the original characters. An optional mode also encodes every non-ASCII character as a numeric entity for maximum compatibility.

How to Use the Tool

• Choose Encode to escape special characters, or Decode to reverse the process
• In encode mode, optionally turn on "encode all non-ASCII characters"
• Type or paste your input to see the converted result instantly
• Use Swap to move the output into the input and flip the mode
• Click Copy to copy the result to your clipboard

Why Encoding HTML Matters for Security

Encoding user-supplied text before inserting it into a web page is one of the most important defenses against cross-site scripting (XSS) attacks. If raw input containing a <script> tag is placed directly into HTML, the browser will execute it. Encoding the angle brackets to entities neutralizes the threat by rendering the text harmlessly.

Beyond security, encoding prevents content from accidentally breaking your layout — for example, displaying code samples, mathematical comparisons, or text that contains ampersands and quotes without the browser misinterpreting them as markup.

Privacy

All encoding and decoding happens in your browser, so your content is never transmitted anywhere and remains completely private.

The Five Essential HTML Entities

While there are hundreds of named HTML entities, five do the vast majority of the work because they correspond to characters with special meaning in markup. The ampersand (&) becomes &amp; and must be encoded first, since it begins every other entity. The angle brackets < and > become &lt; and &gt; so the browser does not mistake them for the start or end of a tag. The double quote becomes &quot; and the single quote becomes &#39;, which matters inside attribute values.

Encoding these five characters is what turns text into safe HTML. If you only remember one rule, it is this: any text that originates from a user or an external source, and is about to be inserted into a page, should have at least these characters encoded. This tool does it automatically, and its optional non-ASCII mode goes further by encoding every character outside the basic ASCII range as a numeric entity for maximum compatibility.

Why Choose Our HTML Entity Encoder / Decoder?

This tool is completely free, needs no signup, and runs entirely in your browser. It encodes the characters that matter for both safety and correct display, and offers an optional mode that converts every non-ASCII character to a numeric entity when you need maximum compatibility. Decoding is just as simple, turning entities back into the original readable characters. Because everything runs locally, your content is never uploaded anywhere.

The HTML Entity Encoder / Decoder is one of more than 200 free tools on ToopTools. If you display user content or code samples on web pages, you can pin it to your personalized My Workspace workspace so it sits beside your other web-development utilities, always one click away. It works on any modern browser, on desktop and mobile.

Is the HTML entity encoder free?

Yes. It is completely free with no limits and no signup. You can encode and decode as much text as you like, as often as you like, without ever creating an account.

How does encoding HTML help prevent XSS?

Cross-site scripting attacks work by injecting markup — such as a script tag — into a page through unescaped input. Encoding the angle brackets to &lt; and &gt; means the browser renders that text as harmless characters instead of executing it as code, which is why output encoding is a core defense against XSS.

What does the 'encode all non-ASCII' option do?

By default the tool encodes only the characters that have special meaning in HTML. Turning on 'encode all non-ASCII characters' additionally converts every character outside the basic ASCII range — accented letters, symbols, emoji, and non-Latin scripts — into numeric entities, which guarantees the text displays correctly regardless of the page's character encoding.

Can I decode HTML entities back to plain text?

Yes. Switch to Decode mode and paste text containing entities to convert them back to the original characters — &lt; becomes a less-than sign, &amp; becomes an ampersand, and so on. This is handy for reading encoded content scraped from pages or stored in databases.

Is my content private?

Completely. All encoding and decoding happens locally in your browser, so your content is never uploaded, logged, or stored on a server. It is safe to use with private or sensitive text.

Tips for Working with HTML Entities

• Always encode user-supplied text before inserting it into a page to guard against XSS
• Encode the ampersand first when doing it manually, since it begins every entity
• Use entity encoding to display code samples so tags render as text instead of markup
• Turn on non-ASCII encoding when you cannot guarantee the page's character set
• Decode entities when you need to read or edit the original text content

Key Features

• Encodes the special characters that have meaning in HTML
• Optional mode to encode all non-ASCII characters as numeric entities
• Decodes entities back to the original plain text
• One-click Swap to reverse input and output and flip the mode
• Instant, as-you-type conversion with one-click copy
• 100% browser-based — your content never leaves your device

How do I escape HTML special characters?

Paste your text and the tool instantly converts characters like <, >, &, and quotes into their HTML entities, so they display as text instead of being interpreted as markup. Switch to decode mode to turn entities back into the original characters.

Does the HTML entity encoder work offline?

Yes. Encoding and decoding run entirely in your browser, so once the page has loaded the tool works without an internet connection and your content is never uploaded — safe for proprietary markup and snippets.