HTML Entity Encoder
Encode text into HTML entities or decode entities back to plain text. Escape the special characters that would otherwise break your markup — and optionally convert all non-ASCII characters to numeric entities.
About the HTML Entity Encoder
In HTML, characters like <, > and & have special meaning, so to display them literally — or to safely insert user content — they must be written as entities such as <, > and &. Forgetting to escape them breaks layouts and opens the door to cross-site scripting.
This tool escapes those characters (and, optionally, every non-ASCII character) so your text renders exactly as written, and decodes entities back to readable text. Everything runs locally in your browser.
Entities come in two forms: named, like © or &, which are easier to read in source but limited to a fixed list the HTML spec defines; and numeric, like © (decimal) or © (hexadecimal), which can represent any Unicode code point, named or not. Both render identically in the browser — numeric entities are simply the universal fallback for characters that have no named entity.
Escaping user-supplied text before inserting it into HTML isn't just a display nicety — it's one of the standard defenses against stored and reflected XSS: if a username, comment or search query is inserted into a page unescaped, a value like <script>...</script> executes as real markup instead of displaying as text. This is exactly why templating engines and frameworks auto-escape output by default, and why hand-rolled HTML string-building is a common source of the bug this tool exists to prevent.
How to use it
- 1Paste text to encode, or entities to decode.
- 2Optionally encode all non-ASCII characters as numeric entities.
- 3Copy the escaped or unescaped result.
Features
- Encode and decode HTML entities
- Escapes &, <, >, " and ' for safe markup
- Option to encode all non-ASCII characters
- Handles named and numeric entities on decode
- One-click copy
Frequently asked questions
What are HTML entities?
HTML entities are encoded representations of characters, like & for & or < for <. They let you display reserved characters literally and include symbols not on the keyboard.
Why escape HTML?
Escaping prevents special characters from being interpreted as markup, which keeps your page rendering correctly and helps prevent cross-site scripting (XSS) when inserting untrusted text.
What is the difference between named and numeric entities?
Named entities use words (©) while numeric entities use code points (© or ©). Both produce the same character; numeric works for any character.
Is my text uploaded?
No. Encoding and decoding run entirely in your browser.
How does entity-escaping actually help prevent XSS?
If user-supplied text is inserted into a page unescaped, a value like <script>...</script> is parsed as real markup and executes. Escaping it to <script> renders the same characters as visible text instead — the core reason templating frameworks auto-escape output by default.
Do I need to escape every character, or just a few?
For plain HTML text content, escaping &, <, > (and " / ' inside attributes) covers the characters with special markup meaning. Encoding every non-ASCII character too is optional and mainly useful for guaranteeing ASCII-only output, e.g. for older systems or strict encodings.