HTML Entity Encoder / Decoder
Escape text for safe embedding in HTML, or decode entities like & and ' back to plain text. Runs entirely in your browser.
Private by construction. The conversion happens in this page's JavaScript. Nothing you paste here leaves your machine, and the tool keeps working with the network unplugged.
Encode escapes the five characters that break or subvert HTML — &, <, >, ", and ' — making arbitrary text safe to drop into element content or attribute values. Decode goes the other way and understands the full range: named entities (é), decimal (é), and hex (é) references all come back as real characters, because decoding uses the browser's own HTML parser rather than a lookup table that covers thirty entities and shrugs at the rest.
Questions this tool gets asked
Which characters does encoding escape?
The five with special meaning in HTML: ampersand, less-than, greater-than, double quote, and single quote. That set makes text safe in both element content and quoted attributes. Other characters (accents, emoji) don't need escaping in UTF-8 pages.
Does escaping make user input safe against XSS?
It is the correct first step for HTML contexts, and the exact escaping shown here is what template engines do. But context matters: text going into a URL, a script block, or a CSS value needs that context's own escaping instead.
Why does decoding handle entities encoding doesn't produce?
Decoding meets text from the wild - scraped pages, CMS exports, feeds - which use hundreds of named and numeric entities. Using the browser's parser means anything a browser would render decodes correctly here.
What is the difference between ' and '?
The same apostrophe. ' is the numeric form and works everywhere; ' is named and, notoriously, was not defined in HTML4, which is why careful encoders emit the numeric form. This one does too.