HTML Entity Encoder
Escape text for HTML and decode entities back to readable characters.
Conversion happens in this page, using a lookup table rather than the browser HTML parser. Nothing is uploaded and nothing is rendered as markup.
HTML has five characters it cannot take literally. An ampersand starts an entity, angle brackets start and end a tag, and quotes end an attribute value. Anywhere those characters need to appear as themselves — in a code sample, in a product name, in text a visitor typed — they have to be written as entities instead.
More about HTML Entity Encoder
This tool converts in both directions. Encoding is the safety-critical one: text going into a page has to be escaped, because unescaped `<` is the entire mechanism behind cross-site scripting. Decoding is the everyday one: something arrives from an API or a CMS export already escaped, sometimes double-escaped, and you need to see what it actually says.
There are two encoding levels. Minimal escapes exactly the five characters that matter, which is all that safety requires and leaves the output readable. Full additionally converts every accented and non-Latin character to a numeric reference, which you want only when the text has to survive a pipeline that is not reliably UTF-8 — an older email template, a legacy CMS field that mangles anything outside ASCII.
The decoder does not use the DOM. The usual shortcut is to assign the text to `innerHTML` and read back `textContent`, which works and is a security hole: it hands untrusted markup to a real HTML parser, and an `<img onerror>` in the input runs before anything is read back. This decoder is a lookup table over a regular expression, so there is no parser to exploit.
Entities it does not recognise are left exactly as written. Dropping them would lose information and guessing at them would invent it, and neither is a good outcome when you are trying to find out what a string really contains.
- Encodes and decodes HTML entities in both directions
- Minimal mode escapes the five characters that matter, and no more
- Full mode escapes every non-ASCII character for pipelines that need it
- Numeric references in decimal or hex, whichever your target expects
- Decoding never touches innerHTML, so hostile markup is never parsed
- Unknown entities are preserved exactly, never dropped or guessed at
- Handles emoji and rare characters as single references, not broken halves
How to use it
- 1Paste your text or your escaped HTML into the input.
- 2Choose Encode or Decode.
- 3When encoding, pick minimal for markup safety or full for a non-UTF-8 pipeline.
- 4Copy the result, or press swap to send it straight back through the other way.
Questions
Which characters actually have to be escaped?
In page text, the ampersand and the opening angle bracket; inside an attribute value, also the quote character that delimits it. This tool escapes all five of them, because that set is safe in every position and costs nothing.
Does escaping HTML make my page safe from XSS?
It is necessary but not sufficient. Escaping protects text placed into HTML; a value going into a URL, a style block or a script needs different escaping, and building HTML from strings at all is worth avoiding where a template can do it.
Why does my text show &amp; instead of &?
It was escaped twice — the `&` of an existing entity was escaped again. Decode once and check whether the result already reads correctly before decoding further.
What happens to an entity this tool does not know?
It is passed through exactly as written. The tool covers the entities that actually appear in copied markup rather than all 2,200 HTML5 names, and leaving the rest intact is safer than dropping them.
Should I use full mode?
Only when something downstream cannot be trusted to handle UTF-8. On a modern page it makes the source much harder to read for no gain, since a correctly declared page displays accented characters perfectly well.