BrowserTools

HTML Entity Encoder / Decoder

Escape or unescape HTML entities safely

By Guga — BrowserTools maintainer, Tbilisi, Georgia Updated 2026-09-04
Free Private No uploads
What is HTML Entity Encoder / Decoder?

HTML has exactly five characters that mean something to the parser rather than to the reader, and this tool converts all of them. Encoding turns the ampersand into &, and then the less-than, greater-than, double quote and apostrophe into their entities, in that order so the ampersand substitution cannot corrupt the others. The result is safe to drop into markup as body text or inside a quoted attribute value. Decoding runs the input through the browser's own HTML parser and reads back the text, which means it resolves every named entity in the specification plus numeric ones such as — or —, not just the five. The two operations are not interchangeable with percent-encoding for URLs, and they are not a substitute for output encoding at the point where untrusted data is inserted.

Convert special characters like <, >, & and quotes to safe HTML entities, or decode entities back to plain text. Essential for embedding code in HTML and debugging encoding issues.

Private HTML Entity Encoder / Decoder In Your Browser

HTML Entity Encoder / Decoder is processed locally with client-side JavaScript. Your files never touch a server, and there is no queue to wait in.

Step-by-Step

How to use HTML Entity Encoder / Decoder

1

Open the Encode tab and paste markup or prose into the Plain input box.

2

Take the escaped output from the result panel and place it where literal angle brackets would otherwise be parsed.

3

Switch to Decode and supply text containing entities, numeric or named.

4

Read back the plain characters, remembering that any real tags in the input are consumed rather than printed.

Key Capabilities
  • Encodes the complete set of five HTML-significant characters, ampersand first
  • Decoding resolves every named and numeric entity the browser's parser recognises
  • Apostrophes encoded as the numeric &#39; form rather than a named entity
  • Amphibious: same tab switch serves both escaping and unescaping
Common Use Cases
  • A developer embedding a code sample inside a paragraph without the browser treating the tags as markup.
  • A support engineer reading a report that shows &quot; and &amp; everywhere and needs the readable version.
  • A student checking which characters must be escaped before a string is placed in a quoted HTML attribute.
Clear Answers

Frequently Asked Questions

How is this different from URL encoding?
They solve different problems for different parsers. HTML entities exist so the HTML parser stops treating a character as markup; percent-encoding exists so the URL parser stops treating a character as a delimiter. A query string needs percent-encoding, an HTML text node needs entities, and applying one where the other belongs produces output that is technically valid and completely wrong.
What happened to my tags when I decoded?
Decoding parses the input as HTML and returns the text content, so anything that parses as a tag is consumed as markup and only its inner text survives. That is a feature when you want readable text from a rendered page, and a surprise if you expected the tags back. Escape the tags before decoding if you need them preserved.
Does this make my input safe from injection?
It neutralises the five characters that matter in HTML text and in quoted attribute values, which covers a great deal of ground. It does not cover a value placed inside a script block, inside a CSS url, or inside an unquoted attribute — those need context-appropriate encoding, and untrusted input still wants a real sanitiser or a framework that escapes at the point of output.
Why is the apostrophe numeric rather than named?
The classic named entity &apos; only became standard with HTML5 and is missing from many older documents and tools, whereas &#39; has always worked. The numeric form was chosen because it is safe everywhere, including in XHTML documents written before the entity was defined.

Related Guides

View all guides →
Encoders & ConvertersURL Encoding: %20, %2F, Plus Signs & RFC 3986Two escaping systems, one job each. Percent-encoding makes a value safe to travel inside a URL: %2F is an escaped slash, %3F an escaped question mark, %20 an escaped space. HTML entities solve a different problem entirely, making text safe inside markup rather than inside an address. Which one you need, what RFC 3986 actually requires, and the three mistakes that break most links are below; to convert a real string instead, the free URL Encoder / Decoder applies exactly those rules locally.