Skip to main content

HTML Entity Encode / Decode

Loading…

About HTML Entity Encode / Decode

The HTML Entity Encoder / Decoder converts special characters to HTML entities (&, <, >, ", ') or decodes HTML entities back to their original characters. Essential for safely inserting user-supplied text into HTML and for reading entity-encoded content.

HTML entities prevent XSS (cross-site scripting) attacks by ensuring characters with special meaning in HTML — like <, >, and & — are displayed as text rather than interpreted as markup.

This tool encodes the full set of HTML named entities and numeric character references. It handles both named entities (&copy;, &nbsp;, &mdash;) and numeric references (&#169;, &#8212;).

Everything runs in your browser. Your data never leaves your device.

Practical Uses for HTML Entity Encode / Decode

  • Safely display user-submitted comments without breaking the page
  • Encode code snippets so they display correctly inside a <pre> block
  • Decode HTML entities copied from a CMS export
  • Escape text before inserting it into an HTML attribute
  • Decode &amp; and other entities from an RSS or XML feed
  • Prepare text containing quotes for safe embedding in an HTML template

How to Use HTML Entity Encode / Decode

  1. Paste your text or HTML.

  2. Select Encode (text → HTML entities) or Decode (entities → text).

  3. Copy the result.

Examples

Example — Encode HTML characters
Input
<script>alert("XSS")</script>
Output
&lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt;
Example — Decode HTML entities
Input
&lt;p&gt;Hello &amp; World&lt;/p&gt;
Output
<p>Hello & World</p>
Example — Encode a comment for safe display
Input
I <3 this tool & use it daily
Output
I &lt;3 this tool &amp; use it daily
Example — Decode an RSS feed snippet
Input
Terms &amp; Conditions apply
Output
Terms & Conditions apply

Who Uses the HTML Entity Encode / Decode Tool

  • Developers escape user-generated content before rendering it in HTML to prevent XSS.
  • Content managers encode code snippets or special characters for display inside a CMS article.
  • QA engineers decode entity-encoded text pulled from HTML source during testing.
  • Technical writers prepare code examples and symbols for safe display in documentation.
  • Support teams decode garbled entity-style text copied from an email or web page.

Comparisons

HTML Encoding vs URL Encoding

HTML encoding and URL encoding both use special escape sequences, but for different contexts. HTML encoding protects characters that have meaning inside HTML markup itself, like < and & — it's what keeps a script tag typed by a user from being interpreted as real code.

URL encoding protects characters that have meaning inside a URL, like spaces and &. A value might need both: text destined for a URL query parameter that will later be displayed on an HTML page may need URL encoding first, then HTML encoding when rendered — each protects against a different context.

Frequently Asked Questions

Why do I need HTML encoding?

HTML encoding converts characters like < and & that have special meaning in HTML into safe representations (&lt; and &amp;). This prevents XSS attacks and display errors when inserting user input into HTML.

What characters get encoded?

< becomes &lt;, > becomes &gt;, & becomes &amp;, " becomes &quot;, and ' becomes &#39;. These are the five characters with special meaning in HTML.

How do I decode &amp; back to &?

Paste the entity-encoded text and select Decode mode. &amp; becomes &, &lt; becomes <, &gt; becomes >, and so on.

Does it encode all Unicode characters?

The default mode encodes only the five HTML-significant characters. Enable full Unicode mode to encode all non-ASCII characters as numeric HTML entities.

What is &nbsp;?

&nbsp; is the HTML entity for a non-breaking space — a space character that prevents the browser from wrapping the line at that point.

Does this prevent XSS attacks on its own?

HTML-encoding output is one essential layer of XSS prevention, but a complete defense also depends on context (attributes vs. text vs. JavaScript) and, ideally, a templating system that auto-escapes by default. Use this tool to understand and manually check encoding, not as a substitute for a security review.

Can I decode entities from an RSS or XML feed?

Yes — RSS and XML feeds commonly contain encoded ampersands, angle brackets, and quotes in text content. Paste the feed's text field here to decode it into normal readable text.

How do I display a code snippet with < and > safely on a web page?

Encode the snippet here first, then place the encoded output inside a pre or code tag in your HTML. This ensures the browser displays the code as text rather than trying to interpret it as markup.