HTML entity encoder and decoder
Escape text so it displays as text rather than markup, or decode entity-laden HTML back into readable characters. Encoding always covers the five characters that change meaning inside a document; optionally every non-ASCII character is converted too, as named or numeric references. Decoding resolves named, decimal and hexadecimal forms while leaving any tags in place.
How to use the HTML Encode / Decode
- Choose Encode or Decode.
- For encoding, pick minimal (the five special characters) or everything above ASCII.
- Paste the text or HTML into the input box.
- Copy the escaped or decoded result from the output box.
The five characters that actually matter
In an HTML document only a handful of characters change the meaning of what follows. < starts a tag, & starts a character reference, and inside an attribute a matching " or ' closes the value early. > is escaped by convention because it costs nothing and protects against a badly written parser. Escaping those five is what stops user-supplied text being read as markup, and it is what the minimal setting does.
| Character | Named | Decimal | Why it matters |
|---|---|---|---|
& | & | & | Starts every other reference — escape it first |
< | < | < | Opens a tag |
> | > | > | Closes a tag |
" | " | " | Ends a double-quoted attribute |
' | ' | ' | Ends a single-quoted attribute (use the numeric form in HTML 4) |
Named versus numeric references
HTML5 defines roughly 2,200 named references, but only a few dozen are widely recognised by humans: , ©, —, …, £. This tool emits those when the "prefer named" box is ticked and falls back to numeric references for everything else. Numeric references are universal — — and — both mean an em dash — and they are the safer choice in XML, RSS and SVG, where only five names are predefined.
When you do not need entities at all
If your page is served as UTF-8 (which it should be, via <meta charset="utf-8">) you can write é, —, ☕ and 中文 directly in the source. Entities are then only needed for the five structural characters, plus non-breaking space where the invisible difference matters. Converting everything above ASCII is useful for email templates, legacy systems, CSV imports into a CMS, and any pipeline where the encoding of a file cannot be guaranteed — at the cost of roughly doubling the size of non-Latin text.
Decoding safely
Decoding here resolves character references only; tags in the input are returned as literal text rather than being parsed and stripped, so <b>A & B</b> becomes <b>A & B</b>. Remember that escaping is context-sensitive: HTML escaping alone does not make text safe inside a <script> block, a style attribute or a URL attribute, which need JavaScript, CSS and URL escaping respectively.
Frequently asked questions
Should I escape every accented character?
Not on a modern UTF-8 page. Escape the five structural characters and write the rest literally. Full escaping is worth it for email HTML and legacy systems with unreliable encoding.
Why does ' sometimes not work?
It is defined in XML and HTML5 but not in HTML 4.01. If you need to support very old parsers, use the numeric form ' instead.
Does escaping HTML make my site safe from XSS?
It is necessary but not sufficient. Text placed inside script blocks, style blocks or href/src attributes needs its own escaping rules on top.
Are my tags removed when decoding?
No. Only character references are resolved; anything that looks like a tag is returned unchanged as plain text.
Privacy
This tool runs entirely inside your browser using WebAssembly and the Canvas/File APIs. Your files are never uploaded to ToolFlint or any third party; you can verify this in your browser's network tab or by switching to airplane mode after the page loads. Read how we process files.
Last updated 2026-09-23.