HTML Entity Encoder / Decoder
Escape text for HTML, or decode &-style entities back to characters.
About the HTML Entity Encoder / Decoder
HTML gives special meaning to a handful of characters: < opens a tag, & starts an entity, quotes delimit attributes. Put raw user text or code containing those characters into a page and the browser misreads it — content disappears into imaginary tags, layouts break, and in the worst case injected script runs. The fix is entity encoding: < becomes <, & becomes &, and the browser displays the characters instead of interpreting them. This tool encodes text for safe embedding, and decodes entity-riddled text back to readable characters.
Encoding here covers the five structurally dangerous characters (&, <, >, double and single quotes) plus any character outside printable ASCII, which is emitted as a numeric entity — handy when your file might travel through systems that mangle UTF-8. Decoding understands the common named entities (&, <, >, ", ', ) as well as decimal (₹) and hex (₹) numeric forms, so text copied out of HTML source, RSS feeds or scraped pages turns back into normal prose.
Everyday jobs: embedding a code snippet in a blog post so if (a < b) displays literally; putting a company name like "R&D Labs" into an HTML attribute; cleaning up an exported document where every rupee sign arrived as ₹. One caution — entity encoding output is for HTML contexts. It is not sufficient escaping for JavaScript strings, URLs or SQL; each context has its own rules (the URL encoder next door handles that case).
Frequently asked questions
- Which characters must be escaped in HTML?
- At minimum & and < in content, plus quotes inside attribute values. This encoder handles all five dangerous characters and non-ASCII text, which is always safe to over-escape.
- What's the difference between ₹ and ₹?
- The same character (₹) referenced by decimal vs hexadecimal code point. Both are valid; the decoder accepts both plus common named entities.
- Does encoding protect against XSS?
- Entity-encoding untrusted text before inserting it into HTML content is a core XSS defence, but the escaping must match the context — attribute, URL and JavaScript contexts each need their own rules. Use a templating engine's auto-escaping where possible.
Related tools
Percent-encode text for URLs, or decode an encoded URL back to plain text.
Base64 Encoder / DecoderConvert text to base64 and back — Unicode-safe, in your browser.
Markdown to HTML ConverterConvert markdown into clean HTML you can paste anywhere.
Regex TesterTest regular expressions against sample text and inspect every match and group.