HTML Entity Encoder / Decoder
Encode text into safe HTML entities, or decode HTML entities back into readable text — updates live as you type.
How to use the HTML Entity Encoder / Decoder
- Type or paste text into the box.
- Click "Encode" to turn special characters into HTML entities, or "Decode" to turn entities back into plain text.
- The result updates live as you keep typing in the chosen mode.
- Click "Copy result" to copy it.
How it works
Encoding replaces the five characters that have special meaning in HTML — < > & " ' — with their named entity equivalents, so the exact text can be embedded inside an HTML document without being misread as markup. Decoding runs in the opposite direction using a lookup table of common named entities (like & and ©) plus support for numeric entities (© or ©), matched with a plain regular expression rather than by handing the string to the browser's HTML parser — that distinction matters, because parsing untrusted text as HTML is exactly how script injection happens, and this tool deliberately never does that. For example, decoding <img src=x onerror=alert(1)> produces the literal text <img src=x onerror=alert(1)> as a string, which is then displayed as plain text — not as a real image tag, so nothing on the page executes.
Frequently asked questions
Is my text uploaded anywhere?
No — encoding and decoding happen entirely in your browser using JavaScript. Nothing is sent to a server.
Which characters get encoded?
The five characters that matter for HTML safety: < becomes <, > becomes >, & becomes &, " becomes ", and ' becomes '. Unicode letters, emoji, and other characters are left untouched, since they display correctly without needing an entity.
Does this ever render the HTML I type in?
No, never. Your input is always treated as plain text data — this tool decodes entities using its own text-based logic, not by asking the browser to parse your input as HTML, so pasting something like a <script> tag never creates a real element, even when decoding.
What happens with a double-encoded entity, like &lt;?
It decodes one level at a time, matching how browsers handle entities: &lt; decodes to < (not all the way to <). If you need to fully unwind a double-encoded string, click Decode a second time.