Tools/Html Entity Encoder

HTML Entity Encoder / Decoder

Encode special characters into HTML entities or decode entities back to readable text. Use Special chars mode for the five critical characters (< > & " '). Use All characters mode to convert every character into its numeric entity (&#NNN;).

All processing happens in your browser — nothing is sent to our servers

Named vs Numeric Entities

Named entities like &lt;, &gt;, &amp; cover the five critical HTML characters and are the most common form of encoding. Numeric entities (&#NNN;) can represent any Unicode code point — useful for obscuring content from naive parsers or encoding characters outside ASCII. Both forms are decoded identically by browsers.

How it works
HTML Entity Encoding / Decoding
Encode
01Input text

Raw text or HTML — may contain characters with special meaning in HTML markup

→
02Character scan

Each character checked against the five critical HTML characters: <, >, &, ", and '

→
03Entity mapping

Special characters replaced with named entities (&lt;, &gt;, &amp;, &quot;, &#39;) or numeric entities (&#NNN;)

→
04Mode check

Special-chars mode encodes only the 5 critical characters. All-characters mode converts every character to its numeric entity

→
05Safe output

Encoded string safe for embedding in HTML — browsers render entities as text, not markup

Decode
01Encoded string

String containing HTML entities — named (&lt;), decimal (&#60;), or hexadecimal (&#x3C;)

→
02Entity detection

Each & ... ; sequence identified as a named or numeric entity reference

→
03Lookup / convert

Named entities resolved via the HTML entity table. Numeric entities converted from code point to character

→
04Character output

All entity references replaced with their corresponding Unicode characters

→
05Plain text

Human-readable string with all entities decoded — original characters restored

Spec: HTML Living Standard §13.5 (named character references), Unicode Standard

HTML entity encoding is essential for XSS prevention. Always encode user input before inserting it into HTML context — < and > as markup delimiters are the primary attack vector.

Frequently Asked Questions