Encode the characters that matter for HTML display or decode named, decimal, and hex entities back to text, entirely in your browser.
Part of our Developer Tools collection — Explore more Developer Tools tools · See also: JSON Formatter, Base64 Encode / Decode.
Quick answer: HTML Entity Encoder — Encode & decode HTML entities Free, no signup, runs in your browser. See below for the interactive tool, 4-step guide and FAQs.
Deep dives from the Tool4SaaS blog — tested workflows, print sizes and fixes.
Reviewed by the Tool4SaaS Editorial Team — In-house reviewers who build and test every tool locally for accuracy across current Chrome, Edge, Firefox, and Safari. Last updated: . See our authors, methodology or contact us.
Encoding turns &, < and > into character references so markup displays as text instead of being parsed. For example, a div holding Hi and bye becomes entity text that a browser shows literally. It does not escape quotation marks, so this is not a complete XSS defense; sanitize untrusted HTML with a dedicated library.
Yes. Decoding runs inside this tab, so & restores an ampersand and < restores an angle bracket. Named, decimal and hexadecimal references are accepted, while an unknown entity stays literal in the output. No upload occurs.
Named forms such as &, decimal forms such as & and hex forms such as & all decode to the same character. Encoding, by contrast, emits a small fixed set for &, <, > and non-breaking spaces. It does not convert quotes or accented letters, so verify output before pasting into templates or CMS fields.
Entities neutralize visible characters but cannot strip event handlers, javascript URLs, or style expressions embedded in hostile markup. For example, lt script gt displays safely, yet pasting raw markup into innerHTML still executes elsewhere. Combine encoding for display with server-side allowlists, CSP headers and framework escaping before rendering untrusted contributions in production.
Encoding converts raw brackets, ampersands and non-breaking spaces into entity references so browsers show code rather than parse it. Example: a div holding Hi and bye becomes entity text that remains visible in a tutorial. The encoder leaves quotation marks, apostrophes, copyright symbols and accented letters unchanged; only a small fixed set of characters is converted. Bloggers, technical writers and support teams can display snippets without layout collapse. Output is copy-ready for Markdown fences, help centers and forum posts. Always encode first when displaying source code. For untrusted markup, pair this display aid with a real sanitizer; the output is not a security boundary.
Reference entities: & becomes & | < becomes < | > becomes > | a non-breaking space becomes . On decode, named forms such as &, decimal forms such as & and hex forms such as & resolve identically. Quotation marks do not become " during encoding, and single quotes gain no numeric shield. Edge case: double encoding turns & into &amp;, which displays literally, so encode once and check the result. The tool caps input at one million characters.
Paste markup with a div holding Hi and bye, choose Encode to obtain entity text, then toggle Decode to restore the original wording. A second trial can convert a table cell containing an ampersand and angle brackets, then decode it back. Limitation: entities alone never sanitize innerHTML scripts, event attributes or javascript URLs; server filtering remains mandatory. For readable structure after securing characters, see /code-minifier. Encoding also converts non-breaking spaces, while ordinary spaces, tabs and line breaks pass through untouched. The one-million-character cap applies in both directions, and an over-limit input returns an error message instead of partial output. A stray ampersand that does not begin a valid reference is preserved unchanged, so malformed input can look identical after decoding. Archive encoded samples alongside sources to simplify regression checks.