HTML Entity Encoder / Decoder

How to use this tool

1. Choose Encode or Decode. Select Encode to convert chosen characters into HTML references. Select Decode to expand recognized references back to readable text.
2. Select the character scope and entity style. Choose Text-safe for &, <, and >; Attribute-safe also escapes quotes; All non-ASCII additionally encodes every character above U+007F. Select Named, Decimal, or Hex to choose the reference notation.
3. Enter your text. Type or paste your input. The output updates instantly.
4. Copy the result. Click the Copy button to copy the encoded or decoded text to your clipboard.

What are HTML entities?

HTML character references let source text represent characters that have special meaning in markup. A reference starts with & and usually ends with ;: for example, < represents the less-than sign, and & represents an ampersand. Numeric references use a Unicode code point, such as © in decimal or © in hexadecimal for ©. This encoder updates as you type and runs in your browser, so you can prepare a text snippet without sending the input to a server.

The default Text-safe scope escapes &, <, and > while leaving ordinary letters, punctuation, and Unicode characters as they are. This is useful when writing literal text inside an HTML text node, such as showing a code sample containing <section>. Attribute-safe mode also escapes both kinds of quotation marks. All non-ASCII mode additionally replaces characters above U+007F, which can help when a downstream system specifically requires ASCII-only source.

Choosing a scope and notation

Scope answers which characters to replace; entity style answers how each replacement is written. Named mode uses a curated set of common references such as ©, é, and —. If a character has no entry in that set, Named mode falls back to a hexadecimal numeric reference. Decimal and Hex modes use numeric references for every selected character. All three forms represent the same code point when the reference is recognized by an HTML parser.

For example, if a documentation author wants to show the literal text <h1>A & B</h1>, Text-safe mode escapes the ampersand and angle brackets but keeps the surrounding words readable. If an application exports ASCII-only markup containing café, All non-ASCII mode can represent é as a named reference, while an emoji without a curated name uses its numeric code point. The output summary reports character counts, UTF-8 byte counts, and the change in text length.

Decoding and its limits

Decode mode expands known semicolon-terminated named references and valid decimal or hexadecimal numeric references. It works on plain text: raw tags such as <strong>hello</strong> stay intact, unknown entity names are left unchanged, and double-encoded input is decoded one layer at a time. The named table is a practical subset rather than the complete HTML5 character-reference list, and Decode does not implement every parsing rule used by browsers.

Use context-aware output handling

HTML entity encoding is not a general-purpose sanitizer or a complete XSS defense. The right escaping depends on where data goes: HTML text, a quoted attribute, a URL, JavaScript, and CSS each have different rules. For production applications, use a template system that escapes for the output context and avoid inserting untrusted strings as markup. A Content Security Policy can add defense in depth, but it does not replace correct output handling. This browser tool is intended for inspecting and preparing text, not auditing an application’s security.