HTML Entity Encoder / Decoder

Escape special characters to HTML entities and decode them back.

What Does the HTML Entity Encoder / Decoder Do?

This tool converts characters that have special meaning in HTML — <, >, &, quotes — into their safe entity forms (&lt;, &gt;, &amp;, &quot;), and decodes any entity-laden text back to plain characters. An optional mode also converts every non-ASCII character (accents, symbols, emoji) into numeric entities like &#233;, useful when your pipeline can't be trusted with UTF-8.

Decoding understands the full set of named entities (&eacute;, &mdash;, &nbsp;…) as well as decimal and hexadecimal numeric forms, because it uses the browser's own HTML parser.

How to Use the Tool

  1. Choose Encode or Decode.
  2. Paste your text or markup — conversion is instant.
  3. For encoding, optionally tick "Also encode non-ASCII characters".
  4. Copy the result.

Why Entity Encoding Matters

  • Displaying code on a web page — to show <div> as text instead of rendering it, it must be written as &lt;div&gt;.
  • Preventing XSS — encoding user input before inserting it into HTML is the fundamental defense against script injection.
  • Valid markup — a raw & in an HTML attribute or XML feed is technically invalid and can break strict parsers.
  • Recovering readable text — decode scraped content or database exports full of &#8217;-style artifacts back to normal punctuation.

Frequently Asked Questions

Which characters must always be encoded in HTML?

The five critical ones: < (&lt;), > (&gt;), & (&amp;), " (&quot;) and ' (&#39;). Inside attribute values the quotes matter most; in element content, <, > and & are the essentials.

What is the difference between &#233; and &eacute;?

Both represent é. &#233; is a numeric (decimal) entity, &eacute; is a named entity. Browsers treat them identically; numeric entities work even where the named set is unavailable, such as XML.

Does encoding protect against all XSS attacks?

Entity encoding is the correct defense when inserting text into HTML content. Other contexts (JavaScript strings, URLs, CSS) need their own escaping rules — always encode for the specific context.

Why would I encode all non-ASCII characters?

If your file passes through systems with unreliable charset handling (old email templates, legacy databases), numeric entities guarantee every character survives, because the file itself stays pure ASCII.