HTML Encode / Decode

Escape text for HTML or decode HTML entities back to text.

0 chars
0 words
0 lines
0 chars
0 words
0 lines

HTML Encoder and Decoder

This tool escapes text so it can be placed safely inside HTML, and turns HTML entities back into normal characters. It's the quick fix for code snippets that disappear in a blog post, user comments that break a layout, or template output full of &.

Why HTML encoding matters

Browsers treat < as the start of a tag and & as the start of an entity. If you paste <b>bold</b> into a page unescaped, the reader sees bold instead of the code. Worse, if user input is inserted raw, a visitor could inject <script> and run code in other people's browsers — a cross-site scripting (XSS) attack. Encoding replaces the dangerous characters with harmless entities:

  • & → &amp;
  • < → &lt; and > → &gt;
  • " → &quot; and ' → &#39;

For example, <a href="x">Tom's</a> becomes &lt;a href=&quot;x&quot;&gt;Tom&#39;s&lt;/a&gt;, which the browser displays literally.

Options

  • Only special characters – the minimal, recommended escaping for UTF-8 pages. Letters, digits, and Unicode text stay readable.
  • Special + non-ASCII – additionally converts every character above ASCII, like é, ©, — and emoji, to an entity. Useful for HTML emails and legacy systems that mangle UTF-8.
  • Entity format – named entities (&copy;) are readable; characters without a name fall back to decimal. Decimal (&#169;) and hex (&#xA9;) references work for every Unicode character.

Decoding HTML entities

Switch to Decode to convert named, decimal, and hexadecimal references back to text. It handles the full HTML 4 set plus &apos;, tolerates &amp without a semicolon, and leaves unknown entities untouched so nothing is lost. Decoding twice is a quick way to clean up double-escaped strings like &amp;lt;.

If you want every single character written as an entity reference, use Text to HTML Entities. For links and query strings, see URL Encode / Decode.

Frequently Asked Questions

In text content, & and < must always be escaped; > is escaped for symmetry. Inside attribute values you also need to escape the quote character that wraps the value — " or '. The default mode of this tool encodes all five, which is safe in both places.

Encoding the five special characters prevents injected text from being parsed as tags or from breaking out of a quoted attribute, which is the core of XSS defence for HTML contexts. It is not enough inside <script> blocks, event handlers, CSS, or unquoted attributes — those need context-specific escaping.

&apos; is defined in XML and HTML5 but was not part of HTML 4, so some older parsers and email clients don't recognise it. &#39; works everywhere. The decoder understands both.

Not if the page is served as UTF-8, which is the default for modern websites. Use the “Special + non-ASCII” option when the HTML will be embedded in a system with an unknown or legacy character set, such as some email templates or old CMS fields.