HTML Encoder / Decoder

What is HTML entity encoding?

HTML entity encoding replaces characters that have special meaning in HTML markup with a text sequence that represents the same character without triggering that meaning. Five characters are escaped by default: & (ampersand, used to start entities), < and > (used to open and close tags), and " and ' (used to quote attribute values). Each has a named entity: &, <, >, ", and ' (an apostrophe has both a named form, ', and a numeric form; the numeric form ' has the widest historical browser support and is what this tool outputs).

Encoding is the correct way to place arbitrary, untrusted, or user-generated text inside an HTML document so it displays literally — as the characters the user typed — instead of being parsed as markup.

HTML encoding vs. HTML formatting — these are different tools

It's easy to confuse the two, but they solve opposite problems:

• HTML encoding (this tool) escapes special characters within text content so that text is safe to embed inside HTML — it does not touch tag structure at all.
• HTML formatting (pretty-printing or minifying) re-indents or compacts an existing HTML document's tag structure — it does not touch the text content inside tags.

If you have a snippet of plain text you want to safely embed inside an HTML page or attribute, use this encoder. If you already have an HTML document and want it readably indented (or minified for production), use the HTML Formatter instead.

Numeric character references — decimal and hex

Besides named entities, HTML supports numeric character references, which encode any Unicode code point directly: ' is the decimal form (code point 39) and ' is the hexadecimal form (code point 0x27) — both represent an apostrophe. This tool's decode mode accepts both forms, in either case for the x/X prefix.

Why decode order matters

A naive decoder that runs several separate find-and-replace passes — for example replacing every & with & first, then replacing every < with < — can accidentally create new entities out of text that was never meant to be live markup. Given the double-escaped input <, a sequential-pass decoder turns & into & first, producing <, and then a second pass over that same string turns it into < — silently reintroducing a live tag character that was never actually escaped markup, just literal text. This tool decodes every entity in a single left-to-right regex pass instead, so < correctly decodes to the literal text <, matching what a real HTML parser does.

A brief note on XSS prevention

Escaping the five characters above is a standard building block of preventing cross-site scripting (XSS) when untrusted text is inserted into HTML content — it stops a string like <script>alert(1)</script> from being parsed as a live tag. That said, this tool is an educational encoder/decoder, not a complete security library: the correct escaping rules differ depending on whether text is placed inside HTML content, an HTML attribute, a URL, inline JavaScript, or CSS, and getting the context wrong can leave a real vulnerability even with "escaped" text. Production applications should rely on a context-aware templating engine or a maintained sanitization library rather than hand-rolled entity escaping.

Which named entities does decode mode support?

Beyond the core five, decode mode recognizes a curated set of commonly seen named entities:   (non-breaking space), ©, ®, ™, …, —, –, curly quotes (‘ ’ “ ”), currency symbols (€ £ ¥ ¢), and a handful of others. This is a practical subset, not the full HTML5 entity table (which has over 2,000 entries) — any entity outside this list decodes correctly if it's numeric, and is left untouched as literal text if it's an unrecognized named entity.