HTML Encoder / Decoder
Encode and decode HTML entities online. Free HTML encoder/decoder - convert special characters to HTML entities and back.
Three steps to get started
Paste your text
Enter the text you want to encode (to convert HTML characters to entities) or the HTML with entities you want to decode.
Click Encode or Decode
Click "Encode HTML" to convert special characters to HTML entities, or "Decode HTML" to convert entities back to plain characters.
Copy the result
Click Copy to copy the encoded or decoded text to your clipboard.
HTML entities and encoding explained
HTML encoding (also called HTML escaping) replaces characters that the HTML parser treats as syntax with character references, so the browser renders them as literal text instead of markup. A character reference always starts with& and ends with ;, and comes in two forms: named(&) and numeric, either decimal (&) or hexadecimal (&). All three produce the same character.
The five characters that need escaping in HTML content are:
&(ampersand) →&- must be escaped first, or you double-encode everything else<(less-than) →<- the character that opens a tag>(greater-than) →>"(double quote) →"- required inside double-quoted attributes'(single quote) →'- required inside single-quoted attributes; note'is valid in HTML5 and XML but not in HTML 4
Escaping is context-dependent
The most common security mistake is assuming these five substitutions are universally sufficient. They are correct for HTML element content and forquoted attribute values - and wrong everywhere else. Inside a<script> block you need JavaScript string escaping, because</script> inside a string literal terminates the block regardless of entities. Inside an href or src you additionally need URL validation, since javascript:alert(1) contains none of the five characters and executes anyway. Inside a style attribute you need CSS escaping. And anunquoted attribute is unsafe no matter what, because a bare space lets an attacker append onmouseover=…. This is the model OWASP describes in its Cross-Site Scripting Prevention Cheat Sheet: pick the escaping that matches the sink.
Beyond security, encoding solves everyday authoring problems: displaying HTML source in a tutorial without it rendering, storing user-submitted rich text in a database column, preparing email templates for clients with inconsistent parsers, and writing technical documentation that contains tag examples. Modern frameworks handle the common case for you - React escapes interpolated values automatically and onlydangerouslySetInnerHTML bypasses it; Django, Jinja2, and Rails ERB auto-escape template variables unless you explicitly mark them safe.
The decoder here handles the full round trip: named entities including , ©, ™,— and –, plus decimal and hexadecimal numeric references such as © and —. Watch fordouble-encoded input - if you see &lt; in your output, the source was escaped twice and needs decoding twice. Everything runs client-side in JavaScript, so you can safely paste payloads, tokens, or customer data without any of it leaving the tab.