HTML Entity Encode/Decode

Unescaped angle brackets or ampersands in a template break the HTML parser, and in user-supplied content they open the door to cross-site scripting (XSS). Type or paste text in the top box and click Encode ↓ to get an HTML-safe version in the bottom box, or paste entity-laden text in the bottom box and click Decode ↑ to get readable text back. Both directions run instantly in your browser, in a Rust module compiled to WebAssembly.

What HTML entities are

An HTML entity is a placeholder for a character that would otherwise be read as markup, or that cannot be typed or transported reliably. Entities start with an ampersand and end with a semicolon. The five that matter most for safety are < for <, > for >, & for &, " for a double quote, and ' for a single quote. Encoding these stops the browser from treating your content as tags or attribute boundaries.

Named versus numeric entities

HTML supports two notations for the same character:

• Named entities: human-readable shorthand like © (copyright),   (non-breaking space), or é (e with acute accent).
• Numeric entities: the character's Unicode code point in decimal (©) or hexadecimal (©), which works for any character, whether or not a named form exists.

Exactly what the encoder does

• & < > become &, < and >.
• Quotes: " becomes " and ' becomes ', so the output is safe inside quoted attribute values too.
• Slash and backtick: / becomes / and ` becomes `, a conservative choice found in earlier OWASP guidance for untrusted data.
• Every non-ASCII character (accents, curly quotes, the euro sign, emoji, Chinese) becomes a decimal numeric entity: é gives é, € gives €. The result is pure ASCII and survives systems with broken encoding.
• Letters, digits, spaces and line breaks are left untouched.

Exactly what the decoder does

• All numeric entities, decimal (é) and hexadecimal (é), are decoded.
• A core set of named entities is decoded: amp, lt, gt, quot, apos, nbsp, copy, reg, trade, mdash, ndash, laquo, raquo and hellip.
• Other named entities, such as é or €, are left as written. HTML defines more than 2,000 names; if your text uses them, replace them with numeric entities or decode them in a full HTML parser.
• Decoding is done once: < becomes <, not <. Click again to decode a double-escaped string one more level.
• Text that only looks like an entity but has no semicolon stays unchanged.

Common use cases

• Preventing broken markup and XSS: escape user-supplied text before inserting it into a page so input cannot inject tags or scripts.
• Pasting code into a CMS: encode a snippet that contains < and > so it displays as text instead of being rendered.
• Email templates: encode accented characters as numeric entities so they display correctly even when a mail client guesses the wrong charset.
• Reading scraped or exported HTML: decode a string full of & and numeric references back into clean, readable content.
• Debugging double escaping: when a page shows & literally, decode step by step to see how many times the text was escaped.

Compared with doing it in code

In production code, use the escaping built into your framework or template engine (React, Jinja, Twig and others escape by default) rather than escaping by hand. Python offers html.escape and html.unescape, PHP htmlspecialchars. This tool is for the manual cases: preparing a snippet for documentation, checking what a template should output, or reading an escaped string from a log.

Privacy: everything runs in your browser

The text you paste is encoded or decoded entirely client-side by a Rust module compiled to WebAssembly. Nothing is uploaded, logged, or stored on a server, which matters when your markup contains internal copy, template code or user data. The tool keeps working even offline once the page has loaded.

Frequently asked questions

Is my text sent to a server?

No. Encoding and decoding run locally in your browser. Nothing leaves the page.

Why are my accented letters turned into numbers?

The encoder converts every non-ASCII character to a numeric entity so the output is plain ASCII. Browsers display é exactly as é. If your page is correctly served as UTF-8, you only need to escape &, <, > and quotes.

Why is é not decoded?

The decoder handles numeric entities and a core set of 14 named entities. Less common names are left untouched rather than guessed.

Is encoding enough to prevent XSS?

It protects text placed in HTML content and quoted attributes. It is not enough inside <script> blocks, in URLs (javascript: links) or in CSS, which each need their own escaping.

Does decoding remove HTML tags?

No. Decoding only replaces entities with characters; tags such as <p> stay in the text. To turn markup into readable text with structure, convert it to Markdown instead.

What is the difference with URL encoding?

HTML entities protect characters inside a web page. URL encoding (%20, %3C) protects characters inside a link or query string. Use the URL encode and decode tool for that.

Related tools

If you are moving content between formats, the HTML to Markdown converter turns HTML into clean Markdown, and the Markdown preview and HTML export tool goes the other way.