Five characters change the meaning of an HTML document: the ampersand, the two angle brackets and the two quote marks. When those appear inside content rather than markup they have to be written as entities, otherwise a browser reads them as the start of a tag or the end of an attribute. This tool escapes exactly those five, or goes further and converts every character above code point 127 into an entity so the output is pure ASCII and safe in any document encoding.
For non-ASCII characters you can choose named entities where a standard name exists, with numeric entities as the fallback, or force decimal or hexadecimal numbers throughout. Decoding works the other way and uses a fixed entity table plus numeric entity parsing, never innerHTML, so pasting hostile markup here cannot execute anything. Entities the table does not recognise are reported and left exactly as written rather than being silently dropped.
How to use the HTML Encoder Decoder
- Pick a mode: escape the five special characters, encode all non-ASCII characters, or decode entities back to text.
- If you are encoding non-ASCII characters, choose named, decimal or hexadecimal entities.
- Paste your text or HTML into the input box and click Convert.
- Check the counts, then click Copy. Use output as input to run the reverse conversion and confirm the round trip.
Frequently asked questions
Which characters actually need to be encoded?
Inside text content, the ampersand and the less than sign are the ones that matter. Inside an attribute value you also need the quote character you used to delimit it. The greater than sign is escaped by convention rather than necessity, and escaping all five is the safe habit.
Do I need entities for accented letters and emoji?
Not on a modern page. If your document declares a UTF-8 charset you can write those characters directly and they will display correctly. Entities are still useful when a file must stay pure ASCII, for example in an email template or a system that mangles the bytes.
Why is the apostrophe written as ' instead of '
The name apos was defined for XML and HTML5 but not for HTML 4, so a few older parsers do not recognise it. The numeric form ' is understood everywhere. The decoder here accepts both, but the encoder writes the numeric version for maximum compatibility.
Does encoding entities make my page safe from XSS?
Escaping is the right defence for untrusted text placed into HTML, but the correct escaping depends on context. Text content, attribute values, URLs and JavaScript each need different treatment. This tool covers the HTML text and attribute case and is not a substitute for server side escaping.