HTML Entity Encode / Decode

Escape text so it shows up as text in HTML instead of being treated as markup, or turn entities back into characters.

🔒 Runs in your browser. Nothing you enter is uploaded.

How to use the HTML Entity Encode / Decode

  1. Choose Encode or Decode
  2. Paste your text or HTML
  3. Copy the result

About this tool

To show “<b>” on a web page instead of making text bold, the angle brackets must be written as &lt; and &gt;. Escaping & < > " ' is also the core defense against cross-site scripting (XSS) when you put user text into HTML. The decoder understands numeric entities (&#169;, &#xA9;) and common named ones (&copy;, &nbsp;, &mdash;).

Frequently asked questions

Which characters must be escaped in HTML?

Always escape & and <. Escape > as well, and escape " and ' inside attribute values. This tool escapes all five.

Should I encode non-ASCII characters?

Usually not. UTF-8 pages show é or 😀 directly. Encode them only for systems limited to ASCII, such as some email templates.

Is this enough to prevent XSS?

Escaping is right for text inside HTML elements and quoted attributes. URLs, JavaScript and CSS contexts need their own escaping, so use your framework’s built-in protections.

Related tools

URL Encode / DecodeMarkdown to HTMLHTML MinifierBase64 Encode / Decode

Updated · Built and maintained by the UtilityBright team · About our tools · Report a problem