HTML Entity Encoder & Decoder Online Free
Ampersands, angle brackets and quotes break HTML templates when inserted raw. This encoder converts them to safe entities — &, <, >, ", ' and numeric forms like — — and reverses the process just as quickly. Choose named entities for readability or numeric codes for full Unicode coverage, skip already-safe characters if you like, and get diff-friendly output for embedding untrusted text inside attributes, paragraphs or JavaScript string literals. All processing is local to your browser.
HTML Entity Encoder & Decoder In-Browser Workspace
Input data or select files to begin. 100% private, client-side execution with zero server transmission.
How to Use HTML Entity Encoder & Decoder
- Step 1: Pick Encode or Decode mode with the toggle.
- Step 2: Paste the raw text (encode) or entity-laden text (decode) into the input box.
- Step 3: Choose named entities for common punctuation or numeric (&#NNN;) for every character.
- Step 4: Optionally leave safe characters untouched to keep diffs minimal.
- Step 5: Copy the result with one click into your template, CMS field or API payload.
About HTML Entity Encoder & Decoder
HTML documents are tokenized by looking for < and > to find tags; an ampersand starts a character reference. If user-supplied text contains those bytes unescaped, browsers mis-parse the document — or worse, attackers inject <script> markup (XSS). Encoding replaces each reserved character with a reference the parser treats as literal text: & becomes &, < becomes <, > becomes >, " becomes " inside attributes, and the apostrophe becomes ' (or ' in XML). Named entities cover ASCII punctuation and a few frequent symbols (©, €, —); everything else uses decimal — or hex — numeric references which encode any Unicode code point. Decoding scans for &name; and &#nnn;/&#xhh; forms, looks them up in a table (or parses the number), and writes the real character back — including double-encoded input like &lt; which becomes < after one pass, so run decode twice when you suspect double encoding. The encoder’s “skip safe” option leaves letters, digits and newlines alone and only touches the five critical bytes plus optionally all non-ASCII, which keeps output human-readable. Correct contextual escaping still matters: JavaScript string literals need backslash escaping beyond HTML entities, and URL parameters need encodeURIComponent — this tool handles the HTML-context layer. Round-tripping encode then decode restores the original string exactly for all inputs the entity set covers.
Frequently Asked Questions
Is this enough to prevent XSS?
It neutralizes HTML injection in HTML context; you still need correct escaping for JavaScript, CSS and URL contexts.
Named vs numeric entities — which should I use?
Named entities are shorter and readable for ASCII specials; numeric entities work for every Unicode character.
Will decoding break normal text?
Decoding only touches valid &…; references; stray ampersands without a valid name are left as-is.
Can I encode quotes for attribute values?
Yes — choose encoding that includes " and ' so attribute delimiters stay balanced.
Is text uploaded anywhere?
No — encoding and decoding run entirely in your browser tab.