Developer

HTML Decode and Encode

Encode and decode HTML entities in Named / Basic and Numeric modes.

Loading interactive tool…

Embed this tool on your site

About this tool

HTML entities are the escape mechanism that allows special characters to appear in HTML without being interpreted as markup. The less-than sign (<) becomes &lt;, the ampersand (&) becomes &amp;, and quotation marks become &quot; or &#39; — each encoding prevents the browser from treating the character as HTML syntax. This encoder/decoder has two entity modes. Named / Basic encodes the five reserved characters plus the non-breaking space (&amp; &lt; &gt; &quot; &#39; &nbsp;) and decodes those names plus any decimal or hex numeric entity. Numeric encodes the reserved characters, control characters such as newlines, and every non-ASCII character as decimal codes like &#169;, and decodes decimal (&#169;) or hex (&#xA9;) entities. Other named entities such as &copy; and &mdash; are left as they are when decoding. Pick Encode or Decode, click Run, and use Swap to feed the output back in. Everything runs in your browser.

Why use it

  • Prevent XSS in HTML Output: Encoding user-supplied text before inserting it into HTML prevents cross-site scripting attacks where injected script tags execute in visitors' browsers.

  • Readable Named Escapes: Named / Basic mode turns & < > " ' and the non-breaking space into &amp; &lt; &gt; &quot; &#39; and &nbsp;, leaving all other characters untouched so the text stays readable.

  • Quotes Always Escaped: Both double and single quotes are encoded in every encode mode, so the output is safe inside quoted attribute values as well as text nodes.

  • Decode CMS and Template Output: Recover plain text from HTML sources that add unnecessary escaping — basic names and all decimal or hex numeric entities are decoded.

  • Non-ASCII to Numeric Entities: Numeric mode encodes accented letters, emoji, symbols and CJK as decimal entities such as &#169; and &#128512; for ASCII-only email or legacy templates.

  • Instant In-Browser Processing: No server round-trip — encoding and decoding runs client-side so your text content stays completely private.

How to use

  1. Choose the Action: Encode (plain text → HTML entities) or Decode (HTML entities → plain text).
  2. Choose the Entity mode: Named / Basic for &amp; &lt; &gt; &quot; &#39; &nbsp;, or Numeric for decimal &#N; codes.
  3. Paste your text into the Input area.
  4. Click Run to produce the output.
  5. Click Copy to copy the result, or Swap to move the output back into Input for another pass.
  6. Click Clear to empty both boxes and start again.

When it helps

  • When embedding user-generated content in HTML and needing to escape it before inserting it into a template to prevent XSS vulnerabilities.
  • When writing inline HTML in a CMS, email builder, or static site generator that interprets < and & as markup syntax rather than literal characters.
  • When inserting a code snippet or command containing angle brackets into an HTML page and needing the characters to display literally.
  • When debugging double-encoded output from a templating engine where < appears in the browser instead of the intended < character.
  • When preparing text for an HTML attribute value that contains quotes, ampersands, or special characters that would break the attribute syntax.
  • When converting a plain-text legal or technical document containing characters like © ™ — into their HTML entity equivalents for proper rendering.

Examples

Encode code snippet for display in HTML (Named / Basic)

Input
<script>alert('XSS & injection');</script>
Expected result
&lt;script&gt;alert(&#39;XSS &amp; injection&#39;);&lt;/script&gt;

Decode entity-heavy CMS output (Named / Basic)

Input
&lt;h1&gt;Caf&#xE9; &amp; Bar&lt;/h1&gt;&lt;p&gt;Your &quot;all-in-one&quot; toolkit &copy; 2026&lt;/p&gt;
Expected result
<h1>Café & Bar</h1><p>Your "all-in-one" toolkit &copy; 2026</p>

Encode special characters for email template (Numeric)

Input
Copyright © 2026 — All rights reserved. Price: $19.99 & free shipping.
Expected result
Copyright &#169; 2026 &#8212; All rights reserved. Price: $19.99 &#38; free shipping.

Tips

  • Always encode at minimum the five unsafe characters (&, <, >, ", ') when inserting any user-supplied or external text into HTML, even if it looks safe — defense in depth prevents XSS.
  • Use the decode direction to quickly read what a heavily entity-encoded string will actually display as in a browser without needing to open a separate HTML file.
  • Inside an href or other attribute, write a literal & in a URL query string as &amp; — browsers decode it back to & before following the link.
  • Non-breaking space (&nbsp;) is one of the most overused entities — replace any &nbsp; used purely for indentation or layout with CSS margin/padding for cleaner, more maintainable markup.
  • Paste a snippet of your template output into the decoder to diagnose double-encoding issues — if the decoded output still contains entity sequences, your pipeline is encoding already-encoded text.

Frequently Asked Questions

What are HTML entities and why are they needed?
HTML entities are text replacements for characters that have special meaning in HTML syntax. The < and > characters delimit tags, & starts entity references, and " and ' delimit attribute values. If these characters appear unescaped in HTML content, browsers may misinterpret them as markup. Encoding them (e.g. < becomes &lt;) tells the browser to display the character literally.
What is the difference between the named quot entity and numeric #39?
&quot; is the named entity for the double-quote character (") and is valid in HTML4 and HTML5. &#39; is the numeric entity for the apostrophe/single quote (') — HTML4 has no named entity for it, though &apos; was added in HTML5. This tool writes &#39; when encoding and decodes both &#39; and &apos;.
Should I encode all characters or only unsafe ones?
For security you must encode at minimum & (&amp;), < (&lt;), > (&gt;), " (&quot;) and ' (&#39;) — that is what Named / Basic mode does. For ASCII-limited environments like older email templates, Numeric mode also encodes every non-ASCII character (© becomes &#169;). Note that Numeric mode encodes newlines too (&#10;).
What is double encoding and how do I detect it?
Double encoding occurs when already-encoded entities are encoded again — for example, &lt; becomes &amp;lt;, which renders literally as &lt; in the browser instead of <. If you see entity text like &amp;amp; or &lt; on the rendered page, something in your pipeline is encoding input that was already encoded. Decode once to recover the intended text.
Does encoding HTML entities protect against SQL injection?
No. HTML entity encoding only protects output that is rendered in HTML contexts (browsers). For database queries, use parameterized queries or prepared statements — these operate at the SQL layer and are unaffected by HTML encoding. Never rely on HTML encoding as your only defense for database-bound input.
What is the &nbsp; entity and when should I use it?
&nbsp; represents a non-breaking space (Unicode U+00A0). Use it to prevent line-breaks between two words that should stay together (e.g. 10&nbsp;km, Fig.&nbsp;1). Named / Basic mode encodes a real non-breaking space character as &nbsp; and decodes &nbsp; back to U+00A0.
Does the decoder understand &copy;, &mdash; and other named entities?
No. Decoding recognizes only &amp; &lt; &gt; &quot; &apos; &#39; and &nbsp; by name, plus any decimal (&#169;) or hexadecimal (&#xA9;) numeric entity. Other names such as &copy; or &mdash; are left unchanged in the output.
Can I use this tool to sanitize HTML from untrusted sources?
Encoding converts characters to entities but does not remove HTML structure. If you paste actual HTML with tags into the encoder, the tags themselves are encoded as text. This tool is for encoding plain-text content for safe insertion into HTML — it is not a full HTML sanitizer. For sanitizing rich HTML from untrusted sources, use a library like DOMPurify.

Explore the category

ASCII Table All 128 ASCII codes in decimal, hex, octal and binary, with each character, HTML entity and name. Filter the table and click a row to copy. URL Encoder Encode and decode URLs Base64 Encode and decode Base64 strings JWT Decoder Decode and inspect JWT tokens JavaScript String Escape Encode and decode JavaScript escape sequences for safe string handling. HTML Formatter Beautify and indent raw HTML code
Base64 Images in HTML and CSS: When They Help and When They Hurt Embedding images as Base64 data URIs eliminates an HTTP request but increases file size by 33% and breaks caching. Here is when the trade-of Apr 2026 · 7 min

Glossary

HTML Entity
A sequence of characters that represents a single character in HTML. Entities begin with & and end with ; and are used to display reserved characters or characters not easily typed. Example: &lt; represents <.
Named Entity
An HTML entity identified by a human-readable name rather than a number. Examples: &amp; (ampersand), &copy; (copyright symbol ©), &mdash; (em dash —). Named entities are defined in the HTML specification.
Numeric Entity
An HTML entity expressed as a Unicode code point number. Decimal format: &#169; (©). Hexadecimal format: &#xA9; (©). Numeric entities work in both HTML and XML contexts.
XSS (Cross-Site Scripting)
A web security vulnerability where an attacker injects malicious scripts into content served to other users. Proper HTML entity encoding of user input is the primary defense when inserting data into HTML context.
Non-Breaking Space (&nbsp;)
Unicode character U+00A0. Unlike a regular space, it prevents a line break at its position and is not collapsed when multiple spaces appear adjacent in HTML source.
Character Reference
The formal HTML term for what is commonly called an entity. A character reference can be named (&amp;) or numeric (&#38;) and always resolves to a single Unicode code point.
A LITTLE HELP. A LOT DONE.
Good tools.
Great flow.

Your shortcut to the everyday. Create, convert, calculate,
and get back to what you love.

✓ Free to use✓ No sign-up✓ 500+ possibilities