HTML Entity Encoder and Decoder with Numeric Entities
Encode or decode HTML entities in text
What is HTML entity encoding?
In HTML, characters like < > & " and ' have structural meaning — they open tags, delimit attributes, start entity references. To display them literally, they must be written as entities: < for <, & for &, " for a double quote. Encoding turns raw text into that safe representation; decoding reverses it, turning &copy; or © back into readable characters.
The encoder here escapes the five security-critical characters (& < > " '), which is exactly what's needed to display untrusted text inside HTML. The decoder handles the full range — named entities, decimal &#NNN; and hex &#xHH; references. Everything runs in your browser: nothing you paste is uploaded or logged.
When to use it
Encode when you need to show code inside a web page — an HTML snippet in a blog post, documentation, or a CMS field that would otherwise be interpreted as markup — or when you're preparing text for an HTML context and want to neutralize characters that could break out of it (the same escaping that prevents reflected XSS). Decode when you've scraped a page, pulled text from an RSS feed, or exported from a CMS and the content arrived littered with &amp;, " and ’ instead of real characters.
Double-encoded text (the telltale &amp;) is a decode job too — run it through once per layer of encoding. When you want a second pair of eyes on a result, the "Copy link to this result" button produces a permalink that restores your input and mode exactly.
Example
Paste <a href="/docs?a=1&b=2">Read the docs</a> in encode mode and Convert. You get <a href="/docs?a=1&b=2">Read the docs</a> — drop that into a page and the browser renders the tag as visible text instead of a link. Feed the encoded version back through decode mode and the original markup returns unchanged, which is a quick way to check that a template or CMS isn't mangling your entities.
How to use the HTML Entity Encoder and Decoder with Numeric Entities tool
- 1
Pick Encode or Decode
Encode escapes markup characters as entities; Decode turns entities back into plain text.
- 2
Paste your text or markup
An HTML snippet to display, or entity-riddled text from a scrape or export.
- 3
Hit Convert
The result appears in the output panel, ready to copy.
- 4
Copy or share
Copy the output, or copy a permalink that restores your exact input and mode for anyone who opens it.
Frequently asked questions
Which characters does the encoder escape?
The five that matter for correctness and safety in HTML: & < > " and ', which become & < > " and '. Other characters pass through unchanged — accented letters and emoji are valid in UTF-8 HTML and don't need escaping.
Why does my text show &amp; instead of &?
It was encoded twice — the & of an existing entity got escaped again, a classic bug when two layers (say, an app and its template engine) both escape output. Decode here once per layer to recover the original, then fix the pipeline so only the final render escapes.
Is encoding here enough to prevent XSS?
It applies the standard escaping for HTML body and attribute contexts, which blocks the common injection vectors. But JavaScript strings, URLs and CSS inside a page each need their own context-specific escaping — for URLs inside attributes, pair this with the URL Encoder / Decoder tool.
Does my markup leave my machine?
No. Encoding and decoding run entirely in your browser — nothing is uploaded or logged. Even the shareable permalink keeps your input in the URL fragment, which is never sent to a server.
Related on TechLogHub
Related Encoding Tools
Get the next tool before you need it
One email a week: new and trending developer tools, fresh comparisons, and what shipped. Unsubscribe in one click.