HTML Encoder/Decoder
Encode and decode HTML entities online for free. Convert special characters to HTML codes and vice versa. Safe for web use.
An HTML encoder replaces the characters that carry meaning in markup with their entity equivalents, so a browser prints them instead of running them. On the Encode tab with Named Entities selected, five characters change: & < > " and '. Encoding <p>Hello & World "quotes" 'apostrophe'</p> turns 42 characters into 76, and the stat strip reports 9 entities found and a size change of +81%.
| Character | Named entity | Numeric entity | Hex entity | Description | |
|---|---|---|---|---|---|
About HTML Encoder/Decoder
Four tabs sit above the tool. Encode and Decode share one input and output pair; Preview renders HTML you paste so you can see what it produces; Entity Reference is a searchable table of named entities filtered by Basic, Symbols, Math, Currency, Arrows or Accents. Everything runs in the browser as you type, with nothing uploaded.
Encoding has four settings. Named Entities touches only the five characters that matter in markup, writing &, <, >, " and ' — note that the apostrophe gets the numeric form, because ' was not part of HTML 4 and older mail clients still mishandle it. Numeric Entities converts those five plus every character above code point 127 into &#NNN;. Hex Entities does the same set in &#xNN; with uppercase digits. All characters converts every single character, which is only useful for obfuscation and multiplies the size several times over.
Decoding does not use innerHTML. The text is handed to DOMParser and the resulting body's textContent is returned, so a string containing a script tag is turned back into visible text rather than executed while you inspect it. Four counters under the output report Input length, Output length, Entities Found and Size change as a percentage, and the Swap button moves the output into the input and flips the mode, which is the quickest way to check a round trip.
What this page does not do: it does not sanitise HTML for publication, and encoding is not a substitute for escaping in the right context. A value going into an attribute, a URL, a JavaScript string or a CSS block needs that context's own escaping, not HTML entities. Use this to display markup as text, to inspect an encoded payload, or to look an entity up — not as the security layer of an application.
Use Cases
How to use
Choose the Encode or Decode tab at the top; Encode is selected when the page opens.
For encoding, pick Named Entities, Numeric Entities, Hex Entities or All characters, which decides how much of the text is converted.
Paste your markup or your encoded text into the input box; the output box updates as you type.
Read the four counters under the output: Input length, Output length, Entities Found and Size change.
Press Copy above the output box to take the result, or Swap to move it into the input and flip the mode for a round trip.
Use the Preview tab to render pasted HTML, or Entity Reference to search a named entity by name or category.
Pro Tips
- Named Entities leaves accented and non-Latin characters alone; only & < > " and ' change. If you need é or a Cyrillic word to survive a legacy pipeline, switch to Numeric Entities before encoding.
- The apostrophe comes out as ', not ', even in Named mode. That is deliberate: ' is XML and HTML5 but was never in HTML 4, so the numeric form is the one that renders everywhere.
- Swap is a one-click round trip. Encode something, press Swap, and the encoded text becomes the input in Decode mode; if what comes back is not identical to what you started with, the original was already partly encoded.
- Watch the Size change counter before encoding a large payload. All characters mode multiplies the length several times over, which matters if the result is going into a size-limited field such as a meta tag or a query string.
- Use the Preview tab to see markup rendered rather than to test attacks. It renders a sanitised version of what you paste, so it will not reproduce every behaviour a real page would have.
Troubleshooting
The output is identical to the input and Entities Found stays at 0.
With Named Entities selected, only & < > " and ' are converted, so text without any of those five characters comes back unchanged. That is correct behaviour. If you need accented or non-Latin characters converted too, switch to Numeric Entities or Hex Entities.
Decoding gives back text that still contains & and <.
The source was double-encoded: the ampersand of each entity had itself been encoded before you received it. Press Decode a second time on the output, or use Swap and run the decode again, until the entities stop shrinking.
Encoded output shows ' where I expected '.
That is deliberate. ' was introduced for XML and HTML5 and was never part of HTML 4, so this tool writes the numeric ' instead, which every browser and mail client renders correctly.
The Size change counter jumps to several hundred per cent.
The encoding type is set to All characters, which converts every character in the text to a numeric entity rather than only the five that matter in markup. Switch back to Named Entities unless you specifically want that obfuscation.
Frequently Asked Questions
To make a browser display characters instead of interpreting them. Without encoding, a < starts a tag and an & starts an entity, so a code sample disappears into the page structure and text pasted from elsewhere can inject markup you did not intend. Encoding rewrites those characters as entities, so they render as the characters themselves.
It is the entity for the ampersand. The ampersand has to be encoded because it opens every other entity: writing & in the source produces a literal & on screen, while a bare & followed by letters and a semicolon would be read as some other entity. It is the first substitution this tool makes, before < and >.
When you have received text that already contains entities and you want the original characters back — a log line, an API field, a copied snippet full of < and &. Paste it on the Decode tab and the output is the plain text. Decoding is for reading and inspecting, not for putting the result straight into a page.
They solve different problems. HTML entities protect characters that mean something to an HTML parser; percent-encoding protects characters that mean something in a URL, so a space becomes %20 and an ampersand becomes %26. A value going into a link needs URL encoding; the same value shown as text on the page needs HTML encoding. Doing one does not do the other.
With Named Entities selected, exactly five: & becomes &, < becomes <, > becomes >, " becomes " and ' becomes '. Everything else, including accented letters and emoji, is left alone. Switch to Numeric or Hex Entities and every character above code point 127 is converted as well.
It is the right defence in one place only: text inserted into the body of a page. A value placed into an attribute, a URL, a JavaScript string or a style block needs that context's own escaping, and a value inserted with innerHTML is not protected at all. Treat this page as a tool for displaying markup, not as an application's security layer.
No. Decoding uses DOMParser and returns the parsed body's textContent rather than assigning to innerHTML, so a payload containing a script tag comes back as visible text and is never executed. That is what makes it safe to paste a suspicious string in order to read what it actually says.
They encode a character by its code point rather than by name: é can be written é or é. Numeric forms work for every character, including ones with no named entity, and they survive pipelines that mangle non-ASCII bytes. Named entities are more readable; numeric ones are more portable.
You can copy the output into a JavaScript string, but do not use HTML entities as a way of escaping for JavaScript itself — a value going into a script needs JSON encoding or a proper escape, not entities. In the browser the equivalent of this page's decode step is DOMParser, which is exactly what the tool uses.
Open the Entity Reference tab, type part of the name in the search box, or narrow it with the Basic, Symbols, Math, Currency, Arrows and Accents filters. The table lists the character next to its named form, so you can copy whichever one your target format accepts.