HTML Entity Encode / Decode
Encode special characters as HTML entities or decode entities such as & and < back to text. Escape user content safely before adding it to a page.
Runs in your browser · Nothing uploaded · No sign-up
Something not working, or missing a feature? Send feedback
About the HTML Entity Encode / Decode
Characters such as <, > and & have special meaning in HTML. Encoding them as entities lets you display code and user text safely; decoding turns entities back into readable characters.
Everything runs in your browser, so your input is never uploaded to a server.
How to use the HTML Entity Encode / Decode
- Choose Encode or Decode.
- Paste the text or HTML.
- Optionally encode all non-ASCII characters, then copy the result.
Example
Input
<a href="/search?q=tom&jerry">Tom & Jerry's</a>
Result
<a href="/search?q=tom&jerry">Tom & Jerry's</a>
Encoded this way, the browser displays the tag as text instead of creating a link.
Common mistakes
- Encoding twice. Encoding & again gives &amp;, which shows up literally on the page. Encode raw text once, at the point where it is inserted into HTML.
- Using HTML escaping inside scripts or URLs. Entities protect HTML text and attributes. Values placed in JavaScript or in a URL need JavaScript string escaping or URL encoding instead.
- Decoding untrusted input before display. Decoding turns <script> back into a real tag. Never insert decoded text from users into a page as HTML.
Works well with the HTML Entity Encode / Decode
- URL Encode / Decode: percent-encode values for URLs.
- HTML Viewer: preview how encoded and decoded HTML renders.
- Unicode Escape / Unescape: turn characters into \u escapes for JavaScript and JSON.
Frequently asked questions
Does encoding protect against XSS?
Encoding text before inserting it into HTML is a key part of preventing XSS, but the right escaping depends on where the text goes (HTML, attributes, URLs or scripts).
Why encode non-ASCII characters?
Only when the page or system cannot handle UTF-8. Modern pages served as UTF-8 do not need it.
Named or numeric entities?
Both work in every browser. Named entities such as & are easier to read; numeric ones such as é work for any character, including those without a name.
Which characters must be encoded?
In text, & and <. In attribute values, also the quote character that delimits the value. Encoding > and both quotes everywhere is simplest and always safe.
Related tools
Base64 Encode / Decode
Decode Base64 to text or encode text to Base64 online, with full UTF-8 and URL-safe Base64 support. Conversion runs in your browser, so nothing is uploaded.
URL Encode / Decode
URL encode or decode text online: percent-encode query string values and full URLs, or turn %20-style escapes back into readable text.
JWT Decoder & Verifier
Paste a JWT to decode its header and payload instantly, read exp and iat as dates and verify HS256 signatures. Tokens are decoded locally, never uploaded.
JWT Generator
Create signed JSON Web Tokens online with HS256, HS384 or HS512 from a custom header and payload. Signing happens in your browser; the secret stays local.
Unicode Escape / Unescape
Convert text to \uXXXX Unicode escape sequences and back online, including emoji and astral characters. Handy for JavaScript, JSON and Java strings.
JSON Escape / Unescape
Escape text for use inside a JSON string, or unescape stringified JSON back to readable text. Handles quotes, backslashes, line breaks and Unicode escapes.