HTML Entity Encoder/Decoder
Escape text for safe use in HTML, or decode named and numeric HTML entities back to text.
Runs in your browser. Your input is processed on your device and is not uploaded to our server.
How to use the HTML Entity Encoder/Decoder
- Paste the text or HTML.
- Choose encode or decode, and whether to encode all non-ASCII characters.
- Copy the result.
Encoding replaces the five HTML-special characters (& < > " ') so text displays literally instead of being interpreted as markup. Optionally every non-ASCII character can be written as a numeric entity. Decoding understands all named entities defined by HTML, plus decimal and hexadecimal references. Escaping for HTML is not enough inside JavaScript, CSS or URLs, which need their own escaping.
Frequently asked questions
Does encoding protect against XSS?
For text inserted into HTML element content and quoted attributes, yes. Other contexts such as scripts and URLs need different escaping.