HTML Encoder & Decoder
Turn special characters into HTML entities so they show as text on a web page, or decode entities back to readable characters.
Characters: 0Words: 0Lines: 0
Why HTML needs entities
A few characters have a special meaning in HTML. A < starts a tag and an & starts an entity, so to show them as ordinary text you write them as entities. The encoder replaces five characters:
- & becomes &
- < becomes <
- > becomes >
- " becomes "
- ' becomes '
Named and numeric entities
An entity is written between an ampersand and a semicolon. It can be a name (©) or a number: © is the decimal code of the character and © is the same code in hexadecimal. Numeric entities work for any character, which is why Encode all non-ASCII uses them: café becomes café, and an emoji becomes a single entity for its code point.
The decoder understands every numeric entity and the common named ones: the five above plus , accented Latin letters, currency signs, typographic quotes and dashes, arrows and a few symbols. It does not contain the full list of more than two thousand HTML names. Anything it does not know, and any entity missing its semicolon, is left exactly as you pasted it.
Encoding and security
Escaping these characters is the standard way to display text from users inside HTML content or inside a quoted attribute. It is not a complete defence: text placed in a script, a style, a URL or an unquoted attribute needs different escaping. In a real application rely on your framework's built-in escaping, and use this page to inspect, test or clean up text by hand. Everything happens in your browser and nothing is uploaded.
How to use the HTML Encode / Decode tool
- Paste your text or HTML into the box.
- Click Encode to escape & < > and quotes, Encode all non-ASCII to also convert accents and symbols, or Decode to turn entities back into characters.
- Click the copy icon above the text to use the result.
Frequently asked questions
What is HTML encoding?
HTML encoding replaces characters that have a special meaning in HTML, such as < and &, with entities such as < and & so a browser shows them as text instead of reading them as code.
Which entities can it decode?
All numeric entities (© and ©) and the common named ones such as &, <, >, ", , ©, é and €. Entities it does not know, and ones without the closing semicolon, are left unchanged.
Does encoding make text safe against attacks?
Escaping & < > and quotes is the standard way to show untrusted text inside HTML content or a quoted attribute. It is not enough inside scripts, styles or unquoted attributes, so use your framework's own escaping in real applications.