HTML Entity Encoder / Decoder
Escape and unescape HTML special characters safely.
Encode & Decode HTML Entities
When you display user-supplied text on a web page, characters like <, >, and & must be escaped into HTML entities â otherwise they break your markup or open the door to cross-site scripting (XSS). This tool escapes those characters and decodes entities back to plain text.
Characters escaped
- & becomes &
- < becomes <
- > becomes >
- " becomes "
- ' becomes '
Decoding too
Switch to Decode to turn any named or numeric HTML entity â including ©, ©, and & â back into its original character using the browser's own decoder.
Security and correctness
Escaping output is the single most important defence against stored and reflected XSS. Whenever you inject dynamic content into HTML, encode it first so the browser renders it as text rather than executing it as markup or script.
100% Private & Processed Locally
Every conversion on this page runs entirely inside your browser using JavaScript. Your data is never uploaded to a server, logged, or stored â making this tool safe even for sensitive payloads such as API responses, configuration files, and access tokens.
Because there is no network round-trip, conversions are instant and work even when you are offline. It is free to use with no sign-up, no rate limits, and no ads injected into your output.
Frequently Asked Questions
Common questions about the HTML Entity Encoder & Decoder.