All tools
All tools › HTML Entities Encoder / Decoder ● Live Developer Tools

How HTML Entities Encoder / Decoder works

  1. Choose the Encode or Decode tab depending on which direction you need.
  2. Paste your HTML, text, or entity string into the input box.
  3. Read the converted result in the output box on the right.
  4. Click Copy to copy the result to your clipboard.
  5. Expand the 'Common HTML entities reference' table to look up specific entity codes.
  • Escape user-submitted text before displaying it in an HTML page to prevent it from being rendered as markup.
  • Decode an entity-encoded string copied from an API response or CMS export back into readable text.
  • Prepare a code snippet containing < and > characters for safe display inside a blog post or documentation.
  • Look up the entity code for a special character like © or — using the reference table.
  • Debug why a page is displaying literal &amp; or &lt; instead of the intended character.

Encoding and decoding both happen locally in your browser — decoding uses a hidden textarea element and never executes the content as live HTML. Nothing is sent to a server.

  • Encodes for HTML entity safety only — this is not a full HTML sanitizer and doesn't validate or strip potentially unsafe tags.
  • Encoding always uses numeric references for non-ASCII characters rather than named entities, even when a named entity exists.
  • Decoding relies on the browser's HTML parser, so behavior for malformed or unusual entity sequences follows browser parsing rules, not a strict specification.

HTML Entities Encoder / Decoder

HTML Entities Encoder / Decoder converts characters like <, >, &, and " to their HTML entity equivalents and vice versa. It also handles non-ASCII characters by encoding them as numeric character references. A collapsible reference table lists common entities.

HTML Entities Encoder / Decoder Runs locally

Input

Output
Similar tools

More Developer Tools tools

See all tools →
LiveDeveloper Tools

.dockerignore Generator

Generate .dockerignore rules to exclude unnecessary files from Docker images. Keep builds fast and images lean by specifying what Docker should ignore during COPY commands and build context.

dockerignoredockerbuild context
LiveDeveloper Tools

.gitignore Generator

Generate .gitignore files from templates for popular frameworks and languages (Node.js, Python, React, .NET, Go). Copy-paste ready for your project with no manual configuration needed.

gitignoregitnode
LiveDeveloper Tools

Base64 Encoder / Decoder

Encode text or files to Base64, or decode Base64 strings back to text.

base64encodedecode
LiveDeveloper Tools

Binary Text Converter

Convert plain text to binary and binary back to readable text.

binarytext encodingascii
LiveDeveloper Tools

chmod Calculator

Convert Unix permissions between rwx and octal notation.

chmod calculatorunix permissionslinux
LiveDeveloper Tools

Content Security Policy Generator

Build a starter Content Security Policy (CSP) header with preset rules for common scenarios. Understand CSP directives, generate production-ready headers, and improve website security against injection attacks.

cspsecurity headersweb security
Guide

How to use

  1. Choose the Encode or Decode tab depending on which direction you need.

  2. Paste your HTML, text, or entity string into the input box.

  3. Read the converted result in the output box on the right.

  4. Click Copy to copy the result to your clipboard.

  5. Expand the 'Common HTML entities reference' table to look up specific entity codes.

Scenarios

Use cases

  • Escape user-submitted text before displaying it in an HTML page to prevent it from being rendered as markup.

  • Decode an entity-encoded string copied from an API response or CMS export back into readable text.

  • Prepare a code snippet containing < and > characters for safe display inside a blog post or documentation.

  • Look up the entity code for a special character like © or — using the reference table.

  • Debug why a page is displaying literal &amp; or &lt; instead of the intended character.

Good to know

Limitations & Privacy

Private by design

Encoding and decoding both happen locally in your browser — decoding uses a hidden textarea element and never executes the content as live HTML. Nothing is sent to a server.

  • Encodes for HTML entity safety only — this is not a full HTML sanitizer and doesn't validate or strip potentially unsafe tags.

  • Encoding always uses numeric references for non-ASCII characters rather than named entities, even when a named entity exists.

  • Decoding relies on the browser's HTML parser, so behavior for malformed or unusual entity sequences follows browser parsing rules, not a strict specification.

FAQ

Frequently asked questions

Why encode HTML entities?

HTML entities prevent user-supplied text from being interpreted as HTML markup. This is essential for preventing cross-site scripting (XSS) vulnerabilities when displaying user content on a web page.

Does it handle named entities like &copy; and &euro;?

Decoding handles all named HTML entities recognized by the browser's HTML parser (via the browser's own textarea-based decoding), so it covers a very wide range including &copy;, &euro;, &hellip;, and more. Encoding uses numeric references (&#NNN;) for non-ASCII characters rather than named entities, for maximum compatibility.

Which characters get encoded automatically?

The five reserved HTML/XML characters — & < > " ' — are always encoded to their named entities. Any other non-ASCII character (accented letters, emoji, symbols) is encoded as a numeric character reference like &#233;.

Is this the same as URL encoding?

No. HTML entity encoding escapes characters for safe placement inside HTML markup or text content. URL encoding (percent-encoding) escapes characters for safe placement inside a URL. They use different character sets and encoding schemes.

How does decoding actually work under the hood?

Decoding sets the entity string as the innerHTML of a hidden textarea element and reads back its value — this lets the browser's own battle-tested HTML parser handle every named and numeric entity correctly, rather than reimplementing entity tables manually.

Can I use this to sanitize untrusted HTML for my website?

Encoding here escapes special characters for safe display as plain text, but it does not sanitize or validate HTML structure. For rendering untrusted HTML safely, use a dedicated sanitization library server-side or client-side, not just entity encoding.

Does decoding execute any scripts in the input?

No. Decoding only reads the resulting text value of the hidden textarea — it never renders the content as live HTML in the page, so scripts or tags in the decoded output are not executed.