HTML Entities Encode / Decode 🔒 Your data never leaves your browser.
Escape special characters for HTML, or turn & back into &.
Ctrl+SDownload
About this tool
Five characters are dangerous in raw HTML: &, <, >, " and '. Left unescaped in user content, they break markup — or worse, open the door to XSS injection. Encoding turns them into entities like & that render as text instead of executing as markup.
This tool encodes and decodes instantly in both directions, with an option to also escape every non-ASCII character as a numeric entity for legacy systems. Everything runs client-side in your browser.
Frequently asked questions
What's the difference between named, decimal, and hex entities?
They're three ways of writing the same character reference — &, &, and & all mean "&". Named entities are the most readable but only exist for a fixed set of characters; decimal and hex work for any Unicode code point.
Why do I need to escape characters like & and < in HTML at all?
Because the browser's HTML parser treats < and & specially — an unescaped < can start a tag it wasn't meant to, and an unescaped & can begin a broken entity reference. Escaping them keeps user-supplied text from being misread as markup.
Does encoding HTML entities protect against XSS?
It's one necessary piece, but not the whole story — it depends on where the text ends up (inside an attribute, a URL, a script block, etc. each need different escaping). Treat this tool as a building block, not a complete sanitizer.
Will decoding entities break real HTML tags in my input?
No. Decoding resolves only character references (&...;), leaving actual tags untouched — so it's safe to paste a whole snippet of markup and decode just the entities inside it.
Is my text sent anywhere when I encode or decode it?
No. Everything happens client-side in your browser; nothing is uploaded.