HTML Entity Encoder and Decoder – Entities Both Ways

Pasting a code snippet into a page, a CMS, or a doc — and watching the browser swallow your angle brackets as markup? This free html entity encoder and decoder converts the characters that carry HTML meaning into entities, and converts entities back into plain text. Everything runs in your browser, so nothing is uploaded, no account is needed, and no signup stands between you and the result.

How to use this html entity encoder and decoder

Three quick steps — no signup, no cost.

1Choose a direction

Encode text into entities so it displays literally, or decode entity-laden text back into readable characters.

2Paste your input

A snippet, a scraped line, or a database value. Encoding replaces the five markup-significant characters; decoding resolves named, decimal, and hexadecimal references.

3Copy the result

Paste encoded output wherever literal characters must show, or decoded output wherever you need to read what the entities were hiding.

Why this html entity encoder and decoder encodes exactly five characters

Enough to stop markup confusion, without mangling your text.

The five characters that matter

&, <, >, ", and ' cover ampersand, angle brackets, and both quotes — the characters that change how markup is parsed.

Ampersand encoded first

Encoding & before anything else prevents a newly created entity from being encoded a second time in the same operation.

Full decoding, not just the big five

Decoding resolves the browser’s complete named-entity table plus decimal and hexadecimal numeric references, so © and © both come back as the same character.

Optional non-ASCII encoding

An extra mode writes every character above ASCII as a numeric reference, for legacy templates and mail systems that are not UTF-8 — while modern UTF-8 pages can simply leave Unicode as it is.

Encoding is not sanitising — and decoded output must be treated as untrusted

This tool fixes display. It does not make arbitrary HTML safe, and the distinction matters.

Encoding covers element text and quoted attributes. In those contexts, escaping the five characters stops user input from being parsed as tags. It does not protect JavaScript contexts, URL attributes such as href and src, CSS, or unquoted attributes — each of those needs its own escaping rules.

Decoded output can look like markup. Decoding <script> gives the literal characters <script>, and this tool never executes that string — but copying it into an unsafe innerHTML sink would create a vulnerability. Treat decoded output as untrusted data and use context-aware escaping at the final output boundary.

Store raw, encode at output. Do not encode data before storing it in a database: store the raw value and encode at the point of display, so the same value can be used safely in different contexts instead of being locked into one escaping.

Watch for double encoding. Encoding text that is already encoded turns & into &, which displays literally as & on the page. If you see doubled entities, decode repeatedly to count the layers, then remove the redundant encode.

HTML Entity Encoder and Decoder FAQs

Short, direct answers to the questions readers ask most.

Encoding replaces the five markup-significant characters: & for &, < for <, > for >, " for double quotes, and ' for apostrophes. Everything else passes through unchanged unless non-ASCII mode is on.

Named entities like © are readable but exist only for a defined list of characters, while numeric references — decimal © or hexadecimal © — work for any Unicode code point. Browsers treat all three identically.

In HTML element and quoted-attribute contexts, yes. It does not protect JavaScript contexts, URL attributes, CSS, or unquoted attributes, which each need their own escaping rules.

The text was encoded twice, usually once in application code and again by a framework that escapes output by default. Decode it repeatedly to count the layers, then remove the redundant encode.

Yes. It runs entirely in your browser with no account, no signup, and nothing uploaded.