&;

HTML Entity Encoder & Decoder – Escape HTML Characters

Escape HTML-sensitive characters or convert entity references back to text.

Runs locallyNo accountFree
InputPlain text
OutputRead only

Ready. Input is processed only in this tab.

Important

Encoding text helps display markup literally. It does not by itself make arbitrary HTML safe to execute.

How to use this html entity encoder / decoder

  1. Enter text or HTML entities.
  2. Select Encode or Decode.
  3. Copy the converted output.

What does an HTML entity encoder do?

HTML entity encoding turns markup-sensitive characters such as <, >, &, quotes and apostrophes into references that a browser displays as text. Use Encode when code examples or user-provided text must appear literally inside an HTML text or attribute context, and use Decode to turn references such as &lt; back into readable characters.

Named, decimal and hexadecimal entities

Named references such as &amp; are easy to read, while decimal and hexadecimal forms such as &#38; and &#x26; represent the same ampersand by code point. The browser can decode all valid forms, but keep the semicolon and match the output to the HTML context where it will be inserted.

Is HTML encoding the same as sanitizing HTML?

No. Encoding makes characters display as text; it does not make an HTML string safe to execute or replace a context-aware sanitizer. Keep untrusted values encoded at the output boundary, and never use this simple converter as a substitute for an XSS review or a sanitizer designed for HTML, URL or JavaScript contexts.

Related developer tools

%20URL Encoder / DecoderSafely encode query values and decode percent escapes such as %20.{ }JSON FormatterPaste JSON, validate it and switch between readable or compact output./.*/Regex TesterRun a JavaScript regex against sample text and inspect each match and capture group.