HTML Entity Encode & Decode
Free HTML entity encoder and decoder. Escape & < > " ' or all non-ASCII to named, decimal or hex entities, and decode any HTML5 entity. Private, in-browser.
- No upload — 100% private
- Instant, on your device
- Free, no sign-up
- Works offline once loaded
How it works
How to use HTML Entity Encode & Decode
Choose Encode or Decode.
To encode, pick whether to escape only & < > " ' or every non-ASCII character too, and whether to use named, decimal or hex entities.
Type or paste your text — the result updates as you type.
Copy the result, or press Swap to send it back the other way and check the round trip.
Why use it
Why use our HTML Entity Encode & Decode tool
Safe escaping for HTML
Escapes the five characters that can break markup or open XSS holes: ampersand, less-than, greater-than and both quotes.
Named, decimal or hex
Output é, é or é — named entities fall back to numeric for characters that have no name.
Every HTML5 entity
Decodes all 2,000+ HTML5 named entities such as ✓ and , plus decimal and hex references to any code point.
Emoji-aware
Characters outside the Basic Multilingual Plane, like 😀, become one 😀 entity instead of two broken halves.
Browser-exact rules
Single-pass decoding (&lt; stays <), Windows-1252 fixes for –-style references and U+FFFD for invalid ones.
Private by design
Everything runs in your browser — paste templates, emails or customer data without anything being uploaded.
FAQ
Frequently asked questions
What are HTML entities?
HTML entities are codes that start with & and end with ; and stand for a character, such as < for < or © for ©. They let you show characters that would otherwise be read as markup, or that are hard to type.
Which characters must be escaped in HTML?
In text and attribute values, escape & < > " and '. That is exactly what the default option does. Other characters only need encoding if your file can't be saved as UTF-8.
Should I use named or numeric entities?
Both work in every browser. Named entities like é are easier to read; numeric ones like é exist for every Unicode character and also work in XML. The apostrophe is written as ' because ' is not part of HTML 4.
Why does &lt; decode to < and not <?
Decoding happens in a single pass, like a browser does: & becomes & and the following lt; is plain text. Decode a second time if your text was double-encoded.
Does encoding HTML entities prevent XSS?
Escaping & < > " ' is the right defence for text placed inside HTML elements and quoted attributes. It is not enough inside <script> blocks, style attributes or URLs, which need context-specific encoding.
Is my text sent anywhere?
No. Encoding and decoding run entirely in your browser. Nothing is uploaded, logged or stored.
Related tools
URL Encode & Decode
Percent-encode, decode and edit URL query parameters.
Base64 Encode & Decode
Encode or decode Base64 text, files, images and data URIs.
Markdown Preview
Live Markdown editor with GitHub-flavored preview and HTML export.
JSON Formatter
Beautify, validate, minify and explore JSON as a tree.
Hash Generator
MD5, SHA-1, SHA-256, SHA-512 and HMAC for text or files.
UUID Generator
Generate v4 and v7 UUIDs in bulk, then validate and decode.
JWT Decoder
Decode JWT header and payload, check expiry, verify HMAC.
Regex Tester
Test JavaScript regular expressions with live highlighting.