HTML Entity Encoder / Decoder
Encode special characters to HTML entities or decode entities back to plain text, entirely in your browser.
Pure browser JavaScript — uses the DOM text node API.
How to use this tool
- Paste text containing special characters.
- Click Encode entities to convert < > & " to < > & ".
- Or click Decode entities to reverse.
Encode special characters to HTML entities or decode entities back to plain text, entirely in your browser.
How it works
HTML entity encoding replaces characters that have special meaning in HTML with safe equivalents called entities. For example, < becomes <, & becomes &, and " becomes ". This prevents browsers from interpreting the characters as HTML tags or attributes.
Encoding is essential when displaying user-generated content in a web page. Without it, a user could inject a script tag into the page -- a cross-site scripting (XSS) attack. Always encode untrusted input before rendering it as HTML.
Decoding does the reverse: it converts HTML entities back to their literal characters. This is useful when you receive HTML-encoded text from an API or database that you need to display or process as plain text.
The tool processes text entirely in your browser, so it is safe for sensitive content. It handles named entities (&), decimal entities (&), and hex entities (&).
Worked example
Safely display a user's comment containing HTML characters
- A user submits the comment: Great price & fast delivery!
- Paste the comment text into the encoder.
- Click Encode.
- Copy the result: <b>Great</b> price & fast delivery!
- Insert this encoded string into your HTML template so the browser renders the literal text, not bold markup.
The page displays the comment as readable text without executing any HTML.
Common mistakes to avoid
- HTML-encoding text that will be placed inside a JavaScript string inside a script tag -- JavaScript context requires backslash escaping, not HTML entities.
- Encoding attribute values but forgetting to also quote them in the HTML -- unquoted attributes can still be exploited even if the content is entity-encoded.
- Double-encoding: encoding text that is already HTML-encoded, which turns < into < and displays raw entity text to users.
Key terms
- HTML entity
- A text representation of a character using an ampersand and semicolon, such as < for < or & for &.
- XSS (Cross-Site Scripting)
- An attack where malicious scripts are injected into a web page viewed by other users. HTML encoding is a primary defence.
- Named entity
- An HTML entity identified by a human-readable name, such as © for the copyright symbol or for a non-breaking space.
Frequently asked questions
- Why encode HTML entities?
- To safely embed user-supplied text in HTML without risking XSS injection.