Skip to content
TechnologyTools

Developer Tools

HTML Entity Encoder & Decoder

Escape text for safe embedding in HTML, and decode named or numeric entities (&, ', ©) back into plain text.

Escaping converts < > & and quotes — the fundamental XSS defense. Decoding supports named and numeric entities.

Encode the Five, Decode Everything Else

In HTML text content, only five characters strictly require entities: & < > " and ' (the last two matter inside attributes). Everything else — accented letters, emoji, currency — belongs as literal UTF-8 in modern pages; encoding é as &eacute; is legacy habit that bloats source and hurts searchability. The trap that costs time: double-encoding, where &amp; becomes &amp;amp; after a second pass through a template — if you see &amp; rendered literally in a page, look for two escaping layers.

How the Tool Works

  1. Paste text or markup and pick Escape to convert <, >, &, quotes into their entity equivalents.
  2. Pick Decode to convert entities — named (&amp;) and numeric (&#60; or &#x3C;) — back into characters.
  3. Escaped output is safe to paste into HTML templates, attribute values, or CMS rich-text sources.
  4. Copy or download the result; nothing is transmitted anywhere.
Formula & Technical Standard
Escaping maps & < > " to &amp; &lt; &gt; &quot;. Decoding recognizes named and decimal/hex numeric entities.

Example Input & Output

Safely display user content
Input: <script>alert("x")</script>
Output: &lt;script&gt;alert(&quot;x&quot;)&lt;/script&gt;
Escaping before rendering user-generated content is the fundamental defense against stored XSS.
Decode pasted entities
Input: Caf&eacute; &amp; Bar
Output: Café & Bar
Content copied from HTML sources often carries entities; decoding restores readable text.

Common Questions

Is escaping the same as encoding for URLs?

No. HTML entities are for embedding text inside HTML documents. URL percent-encoding is a different scheme — use the URL Encoder for query strings.

Which entities does decoding support?

All standard named entities plus decimal and hexadecimal numeric references, the same set browsers support.

Security

URL Encoder & Decoder

Convert special characters to percent-encoded hex sequences (%20) and decode URI strings.

Developer Tools

HTML Formatter & Minifier

Beautify or minify HTML markup with before/after payload reduction metrics and client-side privacy.

Text Tools

Text to ASCII Codes Converter

Show the ASCII/Unicode code point of every character in decimal, hexadecimal, or binary — and convert code lists back into text.