HTML Encoder / Decoder

Convert text into HTML entities, or turn entities back into the characters they stand for. Paste in either direction, pick how much to escape and how the entities should be spelled, and the result updates as you type.

Why encode HTML at all

A browser reads <, > and & as markup instructions, not as text. Writing 5 < 10 straight into a page can silently swallow everything after the <, and dropping user-supplied text into HTML without escaping it is the classic cross-site-scripting bug. Encoding replaces those characters with references — <, >, & — that render as the original character but can never be mistaken for a tag.

How to use it

1. Paste your text (or upload a .txt/.html file) into the input box.
2. Pick a Direction — Encode, Decode, or Auto-detect.
3. For encoding, choose which characters to escape and the entity format.
4. Copy or download the result.

Settings

Direction

• Encode — literal characters become entity references.
• Decode — entity references become literal characters.
• Auto-detect — decodes only when the text contains resolvable entities and no bare </> outside them. So <p>Hi</p> decodes, while <p>Tom &amp; Jerry</p> — real markup that happens to contain an entity — is encoded instead.

Encode which characters

• Markup characters only — &, <, >, " and '. The five that change how markup parses, and all you need for escaping text into a page or an attribute value. This is the default.
• Markup + backtick + control characters — adds the backtick (older Internet Explorer accepted it as an attribute delimiter) and every non-printable ASCII control character except tab, newline and carriage return.
• All of the above + every non-ASCII character — also encodes accents, emoji, dashes and symbols, so the output is pure ASCII and survives transports that mangle UTF-8.

Entity format

• Named — <, ©, —. Readable, and the usual choice. Characters with no named reference fall back to hexadecimal automatically.
• Decimal — <, ©.
• Hexadecimal — <, ©.

All three decode identically, so the format is purely about what you want the encoded text to look like.

Which named entities are supported when decoding?

The full Latin-1 range plus the common HTML4 symbol, punctuation, Greek-letter, arrow and card-suit entities — around 198 names, which covers everything a real encoder emits. Numeric references (© and ©, either case) always work regardless of the character. An unrecognised name is left untouched rather than dropped, so nothing goes missing.

Does encoding make untrusted HTML safe to display?

Encoding the markup characters makes untrusted text safe to insert into a page — it will be shown as text, never executed. It does not sanitise HTML you intend to render as markup; that needs an allowlist-based sanitiser, not an encoder.

Privacy

Everything runs in your browser. The text you paste is never uploaded, and files you load are read locally.

Related tools

If you only ever need one direction, HTML Decode is the decode-only version. To escape only the non-ASCII characters and leave markup alone, use Unicode to HTML Entities. For percent-encoding a URL rather than escaping markup, use the URL Encoder / Decoder.