HTML Encoder/Decoder
Encode special characters to HTML entities or decode entities back to plain text. Supports all standard HTML entity codes. All processing happens locally in your browser — nothing is sent to any server.
Info
HTML encoding converts special characters into HTML entity codes so they display correctly in web pages. Decode reverses this process.
🔒 All processing happens locally in your browser — nothing is stored or sent to any server.
All processing happens locally in your browser — nothing is stored or sent to any server.
How to Use This HTML Encoder/Decoder
- Paste or type your text into the input field.
- Click Encode to convert special characters to HTML entity codes.
- Click Decode to convert HTML entities back to plain text.
- Click any encoded text to copy it to your clipboard.
- Use Load Sample to see an example with common HTML special characters.
About HTML Encoding
HTML encoding is essential for web security and proper text display. When browsers parse HTML, certain characters have special meaning — for example, <script> would be interpreted as a JavaScript script tag, not as the literal text "<script>". By encoding these characters, they display as plain text rather than being executed as HTML.
The most critical characters to encode are ampersands (&), which begin all HTML entity sequences, and angle brackets (< and >), which define HTML tags. Failing to encode user input before displaying it on a webpage is one of the most common causes of XSS (cross-site scripting) vulnerabilities.
This tool handles all standard HTML5 named entities plus numeric entities (both decimal like < and hexadecimal like <). All processing is done client-side with JavaScript — your text never leaves your browser.
Frequently Asked Questions
What is HTML encoding? ▼
HTML encoding (also called HTML entity encoding) converts special characters like <code><</code>, <code>></code>, <code>&</code>, and <code>"</code> into their equivalent HTML entity codes (e.g. <code>&lt;</code>, <code>&gt;</code>, <code>&amp;</code>, <code>&quot;</code>). This ensures text displays correctly in HTML documents without being interpreted as HTML markup.
When should I encode HTML? ▼
Encode HTML when displaying user-provided text on a web page to prevent XSS (cross-site scripting) attacks, or when you need to display characters that have special meaning in HTML (like < and >). Any time you show raw text in an HTML context, encoding is a security best practice.
What entities are encoded? ▼
The most important entities encoded are: <code>&</code> (ampersand), <code><</code> (less-than), <code>></code> (greater-than), <code>"</code> (double quote), and <code>'</code> (apostrophe). This tool also handles newlines, tabs, and spaces for display in HTML.
Can I decode HTML entities back to text? ▼
Yes. Paste any HTML-encoded text and click Decode to convert entity codes back to their original characters. This is useful for reading HTML source code, debugging, or extracting text from HTML documents.
Is this tool secure? ▼
This tool runs entirely in your browser using JavaScript. No data is sent to any server. The encoding and decoding happens locally on your device, making it completely private.
What is the difference between HTML encoding and URL encoding? ▼
HTML encoding turns special characters into HTML entities (e.g. <code><</code> becomes <code>&lt;</code>) so they render as text inside an HTML document. URL encoding turns special characters into percent-encoded sequences (e.g. <code> </code> becomes <code>%20</code>) so they survive transmission inside a URL. They solve different problems and use different escape sequences — for URL encoding use our URL encoder/decoder tool.
Why do I see "&amp;" in my output? ▼
That is encoded HTML for "&". If your input already contained an entity like <code>&lt;</code> and you encoded it again, the ampersand gets encoded a second time, producing <code>&amp;lt;</code>. Decode once first, or paste the original raw text instead of the already-encoded version.
Should I HTML-encode strings before storing them in a database? ▼
No — store the raw text and encode it only when rendering it into HTML. Encoding at storage time creates problems when the same data needs to be used in non-HTML contexts (JSON APIs, plain-text emails, CSV exports), and it bloats your database. The right place for HTML encoding is the template engine or the rendering layer.
What about named entities like &eacute; for é? ▼
Modern web pages serve UTF-8, so non-ASCII characters like é, ü, or 漢 work directly without encoding. Named entities for accented characters were necessary in older Latin-1 documents but are now optional. The minimum entities you must always encode are <code>&</code>, <code><</code>, <code>></code>, and (inside attribute values) <code>"</code> and <code>'</code>.