HTML Entity Encoder and Decoder guide
Encode HTML-sensitive characters or decode common named, decimal, and hexadecimal character references locally.
What this tool does
Encode mode replaces five characters that commonly require representation in HTML text: ampersand becomes &, less-than becomes <, greater-than becomes >, double quotation mark becomes ", and apostrophe becomes '. An optional setting converts non-ASCII Unicode code points to decimal numeric references.
Decode mode reverses those common named references and supports decimal forms such as © plus hexadecimal forms such as 🙂. Unknown named entities are left unchanged rather than guessed. This limited, explicit behavior makes the result repeatable but does not attempt to implement the entire HTML named-character-reference catalog.
Entity encoding changes text representation. It is not a complete cross-site scripting defense and is not interchangeable across HTML text, quoted attributes, URLs, JavaScript, CSS, SQL, or template syntax. Secure output handling depends on the destination context and framework.
How to use it
- Select encode or decode mode.
- Paste the source text.
- In encode mode, decide whether non-ASCII characters should become numeric references.
- Select the conversion button.
- Copy the result and use it only in the context for which it was prepared.
When writing a React or another modern framework application, prefer the framework’s normal text interpolation and escaping rules instead of manually building HTML strings. Avoid unsafe raw-HTML APIs unless content has been sanitized for that exact use.
Benefits
- Encodes five common HTML-sensitive characters
- Optionally converts non-ASCII code points numerically
- Decodes common named plus numeric references
- Preserves unknown named entities for review
- Keeps source code and content on the device
Encoding, escaping, and sanitization
Escaping makes data safe for a particular output location by representing special characters. Sanitization parses and removes or allows markup according to a security policy. Validation checks whether input follows expected rules. These operations solve different problems.
Encoding an attacker-controlled string for HTML text does not automatically make the same value safe inside a URL, script, style block, or event handler. Double encoding can also create visible entity text such as &lt; rather than the intended character. Track whether data is raw or already encoded.
Use the XML Formatter to validate and indent a complete XML document. Use the Unicode Escape Converter when you need JavaScript or code-point escape notation rather than HTML character references.
Security notice: Do not rely on this utility alone to secure untrusted HTML. Use maintained framework escaping and a context-appropriate sanitizer or security library.