HTML entity encoder and decoder
Turn an HTML snippet into text you can display in a page, or make common entities such as & and < readable again. The result is shown as text for you to inspect and copy.
Runs in your browser — your input is not uploaded to ToolsNow.
How to use
- Choose Encode or Decode. Encode escapes markup characters. Decode turns supported named and numeric entities back into characters.
- Paste the text. For example, encoding <b>Hello</b> gives <b>Hello</b>.
- Copy for the right destination. Use the encoded result in an HTML text context. Check if your template or CMS already escapes text, since escaping it again can leave entity names visible.
Questions
Which characters are encoded?
The encoder replaces &, <, >, double quotes and single quotes with &, <, >, " and '. It does not convert every non-ASCII character into an entity.
Why did © stay unchanged?
The decoder supports six named entities: &, <, >, ", ' and . Other named entities are left as written. Decimal and hexadecimal numeric forms work for valid Unicode code points: A and A both become A. Include the semicolon.
Does this sanitise HTML or prevent XSS?
No. Escaping text for an HTML text node is different from sanitising markup or preparing data for a URL, script or style block. Use context-aware escaping in your application. Decoding untrusted entities and then inserting the result as HTML can reintroduce markup.
Why does a decoded still behave differently from a space?
It becomes a non-breaking space, U+00A0, rather than an ordinary space. It looks similar but prevents wrapping at that point. Decoding the entity does not remove that behaviour.
Published by ToolsNow. How tools and sources are checked · Report a problem