HTML Encoder & Decoder
Escape text to safe HTML entities, or decode HTML entities back to plain text.
Displaying user-supplied or arbitrary text inside HTML safely requires escaping characters that have special meaning in markup — a literal < or & in unescaped text can break page structure or, worse, open the door to cross-site scripting if the text ends up interpreted as executable markup rather than plain content.
This tool converts the five characters with reserved meaning in HTML (&, <, >, ", ') into their corresponding named entities (&, <, >, ", '), making text safe to embed literally inside HTML markup. The Decode tab reverses the process, converting HTML entities — including numeric decimal (A) and hexadecimal (A) entities, not just the common named ones — back into their original characters.
Both directions run entirely in your browser using straightforward character mapping, so nothing you enter is transmitted anywhere.
How to use HTML Encoder & Decoder
- 1
Choose a direction
Use Encode to escape special characters, or Decode to reverse HTML entities.
- 2
Paste your text
Enter the text or HTML-entity-encoded string.
- 3
Copy the result
The converted output updates live and can be copied instantly.
Features
- Encodes the five reserved HTML characters to named entities
- Decodes named, decimal, and hexadecimal HTML entities
- Live conversion as you type
- Runs entirely client-side — nothing is transmitted anywhere
Frequently asked questions
Common mistakes to avoid
- Encoding text multiple times, turning & into &amp; through repeated encoding passes.
- Assuming HTML encoding alone is sufficient XSS protection in all contexts — different output contexts (HTML attributes, JavaScript, URLs) require different escaping rules.
Get new tools in your inbox
One email a month with new tools, guides, and updates. No spam, unsubscribe anytime.