Output appears here...How to use
01
Paste text or markup
Add the string you need to escape, or the entity-filled HTML you want to read. The Try sample button loads a link tag with an ampersand and quotes.
02
Click Encode or Decode
Encode swaps the special characters for entities. Decode expands named entities plus decimal and hex codes, so © and © both come back as the copyright sign.
03
Copy the safe output
Use the Copy button to move the escaped string into your template or attribute, or the decoded text back into your editor.
Why HTML Entity Encoder
- Two-way conversion of html entities. Encode special characters or decode them back, all in one html encode decode flow.
- Handles named and numeric html character codes on decode, including & and '.
- Runs in your browser. Your text never leaves your device.
- Use it to html escape text before you drop it into an attribute, so quotes and angle brackets stay safe.
- Free with no limit. This html encode online tool has no sign up and no cap.
Common questions
What do HTML entities actually protect against?
They stop the browser from mistaking data for markup. If a commenter writes a script tag and you print it raw, the browser runs it; print <script> instead and it displays harmlessly. Encoding user input this way is the classic defense against stored XSS.
Which characters does the encoder replace?
Five of them: & becomes &, < becomes <, > becomes >, the double quote becomes ", and the apostrophe becomes '. These are the html character codes that matter for safety; accented letters are left alone because modern UTF-8 pages don't need them escaped.
Does html decode handle numeric character references?
Yes, both flavors. Decimal references like © and hex ones like © are converted, along with the common named set including &, <, >, ", and . That makes html decode online useful for reading text copied out of feeds or scraped pages that arrive full of entity soup.
Is there a difference between html character entities and character codes?
Only naming. The phrase html character entities usually means the named forms like &, while a numeric reference points at the character's code position instead. Both spell out the same characters, and the Decode button handles either style.
When should I html encode attribute values?
Any time a value contains quotes or ampersands and comes from data you don't control. An unescaped double quote inside href or title ends the attribute early and lets the rest of the string inject markup. Running the value through html encode online first keeps the attribute sealed.
Can this tool parse or restructure a whole document?
No. It's an entity tool, not an html parser online, and it won't reorganize markup the way a general html converter would. For indentation and structure, the HTML Beautifier is the right page; come back here when individual characters need escaping.
Do I need separate tools for each direction of html encode decode?
No, the pair lives on one page. Encode before you publish untrusted text, then paste anything suspicious back later and decode it to audit what was stored. Round-tripping a string is also a quick html entity decode test when output looks doubled, like seeing &amp; on a live page.