Free Developer Tool - runs 100% in your browser
HTML Entity Encoder
Scroll down to learn more about this tool
Encode and decode HTML entities online
This HTML entity encoder/decoder escapes the characters that have special meaning in HTML -<, >, &, " and ' - into their entity forms (<, >, &, ",'), and decodes any entity - named, decimal or hex - back to plain text. An optional mode also converts every non-ASCII character (accents, emoji, symbols) to numeric entities for maximum compatibility.
Why escaping HTML matters: XSS prevention
Injecting user input into a page without escaping is the root cause of cross-site scripting (XSS). If a username like <script>steal()</script> lands in your HTML unescaped, the browser executes it. Entity-encoding turns that markup into inert text the browser merely displays. Every template engine's "escape by default" behavior is doing exactly what this tool shows you.
Common uses
- Displaying code samples on a web page without the browser interpreting the tags.
- Decoding scraped or exported content full of
&and’. - Embedding text in XML/RSS feeds, where the same five characters must be escaped.
- Writing HTML inside HTML - like the placeholder examples on this very page.
Encoding and decoding run entirely in your browser using the DOM's own parser, so the output matches exactly what browsers understand. Want to see your markup rendered instead? Open theHTML preview.