Runs in your browser. Your files and text never leave your device - nothing is uploaded.
Encode and Decode HTML Entities Online
The Tools Kit’s free HTML Entity Encoder escapes the characters that break markup, turning &, <, >, double quotes and apostrophes into &, <, >, " and '. It also works as an HTML entity decoder: paste encoded text and it converts every named, decimal or hex entity back into readable characters.
Use it when you need to show a code sample on a web page, escape HTML special characters before dropping text into a template, or unescape a string full of & and " codes. Both directions run in your browser, so nothing you paste is uploaded.
How to Use the HTML Entity Encoder
- 1
Paste your text or HTML on the left
Type or paste the plain text, code sample or HTML snippet you want to escape into the Plain Text / HTML box. It starts with a short sample you can replace.
- 2
Choose the format and click Encode
Pick named, decimal or hex entities, and whether to encode only the five reserved characters (&, <, >, " and ') or every non-ASCII character too. Press Encode and the result appears in the Encoded Entities box on the right.
- 3
Or decode entities back to text
Paste entity-encoded text into the right box and press Decode. Every named, decimal and hex entity is converted back to its character, and the result replaces the contents of the left box.
- 4
Copy the encoded output
Click Copy Encoded to put the contents of the right box on your clipboard, ready to paste into a template, CMS field, blog post or config file.
Both boxes are editable, and conversion only happens when you click a button, so you can tweak either side before converting. There is no sign-up and no limit on use.
Which Characters Need Escaping in HTML?
Only a handful of characters have special meaning to an HTML parser. The angle brackets open and close tags, the ampersand starts an entity, and the two quote marks end attribute values. These are the five characters the encoder always converts:
| Character | Encoded as | Numeric form | Why it matters |
|---|---|---|---|
& | & | & | Starts every entity, so a literal ampersand must be escaped |
< | < | < | Opens a tag; unescaped it can turn text into markup |
> | > | > | Closes a tag; escaped for symmetry and safety |
" | " | " | Ends a double-quoted attribute value |
' | ' (this tool) | ' | Ends a single-quoted attribute value |
By default everything else, including accented letters, currency symbols and emoji, passes through unchanged. On a page served as UTF-8 those characters display correctly without entities, so leaving them alone keeps the output readable. If the text is going somewhere that is not UTF-8, such as an old template or an ASCII-only system, choose “Those plus every non-ASCII character” and pick named, decimal or hex references. Strictly, > and the quote marks are only dangerous in certain places, but escaping all five everywhere is the simple, safe rule.
Worked Example: Escaping an HTML Snippet
The tool loads with this sample in the left box:
<div class="greeting">Hi & welcome!</div>Clicking Encode produces:
<div class="greeting">Hi & welcome!</div>Paste that second line into a page and visitors see the original tag as text instead of an invisible div. Paste it back into the right box and click Decode, and you get the original snippet again. The encoder replaces all five characters in a single pass, so an ampersand it has just written is never escaped a second time within the same run.
If you are publishing a longer code sample, tidy it with the code beautifier first and then encode it, so the indentation survives inside your <pre> block. Writing in Markdown instead? The Markdown to HTML converter escapes ampersands and angle brackets in your source as part of the conversion.
HTML Encoding vs URL Encoding and Other Escapes
Each place text can go has its own escaping rules. HTML entities protect text inside page content and quoted attributes. A value that goes into a link or query string needs percent encoding instead, which the URL encoder handles, turning a space into %20 and an ampersand into %26. Binary data or text that must survive any transport unchanged is usually wrapped with the Base64 encoder.
XML uses the same five escapes as HTML, so this encoder works for XML text values too. After escaping, you can check that a document still parses with the XML formatter. JSON is different: it escapes quotes with a backslash, not an entity, which the JSON formatter will flag if you get it wrong.
Watch out for double encoding. Encoding text that is already escaped turns & into &amp;, and readers see raw codes on the page. If a string already contains entities, decode it first, then encode it once.
Common uses
- Showing HTML, XML or JSX code samples in a blog post or documentation page
- Escaping user-supplied text before writing it into an HTML template by hand
- Putting quotes safely inside an HTML attribute value
- Decoding entity-heavy text copied from an RSS feed, API response or page source
- Fixing a CMS field that shows
&or"instead of the real characters
If you need to pull the text content out of a whole page rather than unescape a string, the HTML to Markdown converter strips the tags and keeps the structure. For more encoders, formatters and converters, browse all developer tools.
HTML entity terms explained
| Term | What it means |
|---|---|
| HTML entity | A text code beginning with & and ending with ; that stands for one character, such as < for < |
| Named entity | An entity that uses a name, such as &, © or |
| Numeric character reference | An entity that uses the Unicode code point, in decimal (©) or hex (©) |
| Escaping | Replacing characters that have special meaning in markup so they display literally |
| Double encoding | Encoding text that is already encoded, which turns & into &amp; and shows raw codes on the page |
| XSS | Cross-site scripting: injecting script through untrusted text placed in a page without proper escaping |
Frequently Asked Questions
An HTML entity encoder replaces characters that have special meaning in HTML with entity codes, so a browser shows them as text instead of treating them as markup. This tool converts &, <, >, double quotes and apostrophes into &, <, >, " and ', and can decode entities back into plain text.
By default, exactly five: the ampersand, the less-than sign, the greater-than sign, the double quote and the apostrophe. Choose "Those plus every non-ASCII character" to also encode accented letters, symbols, non-breaking spaces and emoji. Plain letters, digits and spaces are never changed.
The named entity ' was not part of HTML 4, so some older parsers and email clients do not recognize it. The numeric reference ' means the same character and works everywhere, which is why the tool uses it.
Yes, if you choose "Those plus every non-ASCII character". With Named format, é becomes é, © becomes © and € becomes €, and characters without a common name, such as emoji, become numeric references like 😀. Choose Decimal or Hex to get numbers for everything. By default these characters are left as they are, which is fine on any page served as UTF-8.
Paste the encoded text into the Encoded Entities box on the right and click Decode. The plain text replaces whatever is in the left box. Decoding handles named entities such as and ©, decimal references such as © and hex references such as ©.
Decoding is done by your browser’s own HTML parser, which knows the complete list of over 2,000 named entities and every numeric reference. Encoding uses names only for the 131 most common characters (Latin-1 letters and symbols plus typographic marks like curly quotes and dashes) and numbers for the rest, which keeps the output widely compatible.
It gets encoded twice. The ampersand at the start of each entity is escaped again, so & becomes &amp; and < becomes &lt;, and the page shows the raw codes. Decode first if you are not sure whether the text has already been escaped.
Escaping these five characters is the core defense when untrusted text is placed inside HTML content or a quoted attribute, but it is not enough on its own for every context. Text placed in a URL, inline JavaScript, CSS or an unquoted attribute needs the escaping rules for that context, and real applications should use their framework’s built-in escaping.
HTML encoding replaces characters with entities such as & so they display safely inside a web page. URL encoding replaces characters with percent codes such as %20 so they can travel safely in a web address or query string. They solve different problems and are not interchangeable.
No. Encoding is a simple text replacement and decoding uses an element created inside the page, so both run entirely in your browser. Nothing you paste is sent, stored or logged.
Reviewed by Raja Jahangir · Last reviewed: October 7, 2026
How do you encode HTML entities?
To encode HTML entities, paste text and the five characters that break markup are replaced: & becomes &, < becomes <, > becomes >, double quotes become ", and apostrophes become '; accented letters and emoji can be encoded too. Decoding reverses any named or numeric entity, including and ©. Both run in the browser, so nothing is uploaded.
Why do you need to escape < and & in HTML?
Escaping < and & in HTML stops a browser reading them as markup. An unescaped < starts a tag, so user text like <script> would run as code, and a bare & begins an entity. Writing them as < and & makes the browser display the literal characters instead of interpreting them.