HTML Entities Encode/Decode

HTML entities are a way to write characters that would otherwise break markup (<, >, &) or have no keyboard key, as safe text sequences like &lt; or &amp;. This tool encodes and decodes such entities right in your browser.

How to use it

• Encode: paste text and characters like <, >, &, and quotes get replaced with their matching entities.
• Decode: paste HTML containing entities (&amp;, &copy;, etc.) to see the plain text.
• Both named entities (&amp;) and numeric ones (&#38; or &#x26;) are supported.

Common uses

• Safely displaying user text (a comment, a message) on a page without risking broken markup or an injected script.
• Embedding HTML code samples in an article or documentation so the browser shows them as text instead of rendering them.
• Decoding content copied from another site where the characters arrived already entity-encoded.

Things to keep in mind

HTML entity escaping only protects against XSS via a page's text content — it does not protect a JavaScript context (innerHTML, eval) or href/src attributes containing unvalidated URLs.

Encode exactly at the point where text gets inserted into HTML, not ahead of time when saving to a database — otherwise the data gets mangled when reused outside an HTML context.