HTML Entity Encoder & Decoder – Free Online Tool
Escape HTML-special characters or decode named, decimal, and hexadecimal entities.
Encode HTML Special Characters
Convert ampersands, angle brackets, single quotes, and double quotes into character references so code and text can be displayed instead of interpreted as markup. Choose readable named entities or numeric decimal and hexadecimal output.
Decode Named and Numeric HTML Entities
Turn common named references such as &, <, ©, and € back into characters. Decimal references such as © and hexadecimal references such as 🎉 are decoded across the valid Unicode range.
Convert Non-ASCII Characters to Entities
Optionally encode accented letters, currency symbols, non-Latin scripts, and emoji as numeric character references. Modern UTF-8 pages usually do not require this, but numeric entities can help with legacy templates and constrained systems.
Use the Right Escaping Context
HTML text escaping is not a universal security sanitizer. Attribute, URL, CSS, and JavaScript contexts have different rules. Keep values quoted and rely on maintained framework escaping or sanitization when handling untrusted markup.
Private Browser-Based Conversion
Encoding, decoding, Unicode iteration, entity counting, and copying run on your device. Pasted text and converted output are not uploaded or included in optional analytics.
Frequently Asked Questions
Everything you need to know about the HTML Entity Encoder & Decoder.
Which characters should be escaped in HTML text?
Ampersands and less-than signs must be escaped when they are literal text. Greater-than signs and quotes are commonly escaped too, especially when values may move into attributes.
What is the difference between named, decimal, and hexadecimal entities?
Named entities use labels such as &. Decimal entities use a base-10 code point such as &, while hexadecimal entities use base 16 such as &. They can represent the same character.
Can this decode emoji numeric entities?
Yes. Valid decimal and hexadecimal references across the Unicode range are decoded, including supplementary characters such as emoji.
Should I encode every non-ASCII character?
Usually not on a correctly configured UTF-8 page. The option is useful for legacy systems or templates that require ASCII-only source.
Does HTML entity encoding prevent every XSS vulnerability?
No. Escaping must match the output context, and entity encoding does not sanitize arbitrary HTML, URLs, CSS, or JavaScript. Use framework escaping and a maintained sanitizer where appropriate.
Is my text uploaded?
No. Encoding and decoding happen entirely in your browser, and your content is not sent to ToolsMint.