EncryptCodecencryptcodec
Tools/Html Entity Encoder

HTML Entity Encoder / Decoder

Encode special characters into HTML entities or decode entities back to readable text. Use Special chars mode for the five critical characters (< > & " '). Use All characters mode to convert every character into its numeric entity (&#NNN;).

All processing happens in your browser — nothing is sent to our servers

Named vs Numeric Entities

Named entities like &lt;, &gt;, &amp; cover the five critical HTML characters and are the most common form of encoding. Numeric entities (&#NNN;) can represent any Unicode code point — useful for obscuring content from naive parsers or encoding characters outside ASCII. Both forms are decoded identically by browsers.

How it works
HTML Entity Encoding / Decoding
Encode
01Input text

Raw text or HTML — may contain characters with special meaning in HTML markup

02Character scan

Each character checked against the five critical HTML characters: <, >, &, ", and '

03Entity mapping

Special characters replaced with named entities (&lt;, &gt;, &amp;, &quot;, &#39;) or numeric entities (&#NNN;)

04Mode check

Special-chars mode encodes only the 5 critical characters. All-characters mode converts every character to its numeric entity

05Safe output

Encoded string safe for embedding in HTML — browsers render entities as text, not markup

Decode
01Encoded string

String containing HTML entities — named (&lt;), decimal (&#60;), or hexadecimal (&#x3C;)

02Entity detection

Each & ... ; sequence identified as a named or numeric entity reference

03Lookup / convert

Named entities resolved via the HTML entity table. Numeric entities converted from code point to character

04Character output

All entity references replaced with their corresponding Unicode characters

05Plain text

Human-readable string with all entities decoded — original characters restored

Spec: HTML Living Standard §13.5 (named character references), Unicode Standard

HTML entity encoding is essential for XSS prevention. Always encode user input before inserting it into HTML context — < and > as markup delimiters are the primary attack vector.

Frequently Asked Questions