HTML Entity Encoder / Decoder

Encode the five characters that break HTML into their entity form, or decode any HTML entity back into plain text. Encoding covers the ampersand, both angle brackets, and both quote marks, which is the set that actually matters for safely placing text into markup.

Plain Text / HTML

Encoded Entities

How was this tool?

Your feedback helps us improve HTML Entity Encoder.

Why use HTML Entity Encoder?

HTML has five characters that cannot appear literally in content without risking a parsing problem. The angle brackets open and close tags, the ampersand starts an entity, and the quote marks end attribute values. Replacing each with its entity form lets the text be displayed exactly as written rather than interpreted as markup. Order matters when encoding, and it is the detail most hand written escape functions get wrong. The ampersand has to be replaced first. Escape the angle brackets first and the ampersands you just introduced get escaped again on the next pass, turning a correct entity into visible junk. Decoding takes the opposite approach and hands the work to the browser by assigning the text to an element and reading back the resulting value. That means every entity the browser knows is understood, not just the small set this tool produces, which is what you want when you are trying to read a string that came from somewhere else.

Key benefits

Escapes exactly the characters that can break markup or enable injection
Decoding understands the full browser entity table, not just the five it encodes
Both panels are editable, so you can paste into either side
Works on a fragment as easily as a whole document
Everything happens locally, so you can safely paste template code

Features

Encodes ampersand, less than, greater than, double quote, and apostrophe
Apostrophe written as the numeric reference for the widest compatibility
Decoding handled by the browser itself, so named and numeric entities both resolve
Side by side panels with a single click each way
Copy button on the encoded output

Popular use cases

Putting a code sample inside an HTML page without it being parsed as markup
Escaping user supplied text before writing it into a template
Reading an entity heavy string pulled out of an XML or HTML feed
Fixing a CMS field that displays raw entities instead of characters

How to use HTML Entity Encoder

1
Paste your text on the left
Put the plain text or HTML snippet you want to escape into the left panel.
2
Press Encode
The five special characters are replaced with their entity equivalents and the result appears on the right.
3
Or work backwards
Paste entities into the right panel and press Decode to recover the original characters in the left panel.
4
Copy the result
Use the copy button to take the encoded output into your template, config file, or CMS field.

Frequently asked questions

Which characters actually need escaping?

Five: the ampersand, less than, greater than, and the two quote marks. The ampersand must come first when escaping, otherwise the ampersands inside the other entities would be escaped a second time and you would end up with &lt; instead of <.

Why is the apostrophe encoded as a number rather than a name?

The tool writes the numeric reference rather than the named one because the named apostrophe entity was not part of HTML 4 and is not recognised by some older parsers. The numeric form works everywhere.

Why does decoding handle more entities than encoding produces?

Decoding is done by the browser, which knows the complete entity table, so accented letters, symbols, and numeric references all resolve correctly. Encoding deliberately touches only the five characters that affect how markup is parsed, which keeps the output readable.

Does escaping make user input safe to display?

Escaping these characters is the core of preventing markup injection when text is placed into page content, and it is necessary. It is not sufficient on its own for every context. Text going into an attribute, a URL, or inline JavaScript needs the escaping rules for that context too.

Is my text sent anywhere?

No. Encoding is a local string replacement and decoding uses an element created in the page. Nothing is transmitted.

Last reviewed: July 2026

How was this tool?

Related tools