HTML Entity Encoder/Decoder
Encode decode HTML entities
Encode decode HTML entities Runs locally in your browser
About the
The HTML Entity Encoder converts the five characters that matter in HTML into their entity form, and decodes them back again. Encoding is what you do before putting text into a page that came from a user, an API or a database, and it is the minimum defence against that text being treated as markup. Decoding is what you do when you are reading a source file or a feed and want the characters it actually represents.
Where people use the
- Escaping text before dropping it into an HTML template.
- Reading a snippet of source that is full of entities.
- Preparing a code sample for display in a page.
- Checking what a feed actually contains before rendering it.
How to use the
- 1
Choose a direction
Press Encode to turn characters into entities, or Decode to turn entities back into characters.
- 2
Paste the text
The field label and the example change to match the direction you picked.
- 3
Convert
Press Convert. The result appears below with a copy button.
- 4
Clear between runs
Press Clear to empty both fields before the next conversion.
Tips and best practices
- Encode before you insert text into HTML; do it once, not twice.
- Numbers and named entities are not interchangeable everywhere; prefer the named forms here.
- URL and JavaScript contexts need different escaping; this is for HTML only.
Frequently asked questions
Which characters are encoded?
The ampersand, less-than, greater-than, double quote and single quote. Those are the characters that change how HTML is parsed, so they are the ones that must be escaped.
Is encoding enough to make user input safe?
For putting text into HTML content, yes. It is not enough on its own for attribute values inside a URL, for JavaScript contexts, or for CSS, each of which needs its own rules.
Why is the ampersand encoded first?
Because the entities themselves start with an ampersand. Encoding it first prevents already-encoded text from being encoded twice.
Does it handle numeric entities like '?
Decoding handles the numeric form for the single quote. Other numeric entities are left as they are, since there are thousands of them.
Is my content uploaded?
No. The conversion happens in your browser, so drafts and internal content stay on your device.