HTML Entity Encoder
How to use
Encodes special characters into HTML entities like &, < and >, or decodes entities back into normal characters. Useful when embedding text safely inside HTML. Paste your text, pick a direction, and copy the result.
- Safely embedding user-generated text containing < or & into an HTML page
- Decoding entity-encoded text copied from a CMS or email HTML source
- Preparing code snippets containing angle brackets for display inside a web page
- Debugging why raw text is rendering as broken HTML instead of literal characters
Which characters have to be escaped, and which only sometimes
Only a handful of characters must be escaped in HTML, and knowing which ones turns a vague habit into a rule. In ordinary text content, the ampersand and the less-than sign are the two that change meaning: the first starts an entity, the second starts a tag. Inside an attribute value, whichever quote character delimits the value must also be escaped, because otherwise it ends the attribute early. The greater-than sign is conventionally escaped as well, though it is rarely required. Everything else is a display or transport concern, not a parsing one.
That distinction matters because over-escaping causes its own bugs. Running an already-escaped string through an escaper again turns & into &amp;, which renders visibly as & on the page: the double-encoding artefact that appears in page titles across the web. When output looks wrong in that specific way, the fix is upstream: find the second escape and remove it, rather than adding a decode to compensate.
Escaping is also a security boundary, not just a rendering one. Cross-site scripting is precisely the failure of untrusted text reaching a page without being escaped for the context it lands in, and the context matters: escaping for HTML text does not make a string safe inside a script block, a URL attribute or a CSS value, each of which has its own rules. Use this tool to understand and inspect what an encoding does; in application code, use the framework's context-aware escaping rather than a manual pass, because the framework knows which context it is writing into and a manual pass does not.
Free and private. Everything runs on your own device, with no account and no uploads.
Special characters like < and & need to be encoded as HTML entities to display correctly and safely inside HTML. This tool encodes or decodes between raw characters and entity syntax.
Unencoded, these characters can be misinterpreted as HTML syntax, breaking the page or creating security issues, encoding them as entities keeps them safely displayed as literal text.
Common named entities like &, <, > as well as numeric character references are supported.
Yes, switch the direction to decode entity syntax back into normal characters.
- 1
Paste your text
Enter text containing special characters, or already-encoded entities.
- 2
Pick a direction
Choose to encode into entities, or decode entities back to normal characters.
- 3
Copy the result
Grab the converted text.
- ·Always encode user-supplied text before injecting it into HTML to avoid it being interpreted as markup.
- ·Watch for double-encoding, running already-encoded text through the encoder again produces garbled entities like &amp;.
- ·Use numeric character references for characters without a common named entity, like less-common symbols.