HTML Entity Encoder / Decoder

Encode text for safe use in HTML — & < > " and ' become & < > " and ' — and optionally turn accented letters and symbols into named or numeric entities. Switch to Decode to turn é, é and é back into é.

This tool runs entirely in your browser.

Loading tool…

How to use the HTML Entity Encoder / Decoder

1Paste your text or HTML.
2Choose Encode or Decode; for encoding, pick whether non-ASCII characters become named, decimal or hex entities.
3Copy or download the result.

What is the HTML Entity Encoder / Decoder?

Five characters have special meaning in HTML: & starts an entity, < and > delimit tags, and " and ' end attribute values. Encoding them is what stops user-supplied text from breaking a page or injecting markup. The minimal mode does exactly that and leaves everything else readable; the other modes also convert characters outside ASCII, which is useful for old systems and email templates that mangle UTF-8.

Decoding understands every named entity in the HTML standard (more than 2,000, such as   … and →) as well as decimal (…) and hexadecimal (…) references. Decoding happens in your browser’s own HTML parser in a sandboxed document, so markup in the input is never rendered or run.

Frequently asked questions

Do I need to encode accented letters like é?

Not on a page served as UTF-8, which is almost every modern page. Encoding only & < > " and ' is enough; use the named or numeric modes for systems that can’t handle UTF-8.

Is HTML encoding enough to prevent XSS?

It is the right defence for text placed between tags and inside quoted attributes. Values used in URLs, JavaScript or CSS need their own escaping — use your framework’s built-in escaping wherever possible.

Is the HTML Entity Encoder / Decoder free and private?

Yes. The HTML Entity Encoder / Decoder is free, needs no account, and runs entirely in your browser. What you type is never sent to a server or stored.

All developer tools →