HTML entity encoder and decoder
Escape characters that would otherwise be read as markup, or decode entities back into the characters they stand for.
Runs entirely in your browser — nothing is uploaded.
How to use
- Choose encode or decode. Encoding makes text safe to display inside HTML; decoding turns entities back into characters.
- Paste your text. Conversion is instant.
- Copy the result. Encoded output can be pasted straight into a template or CMS field.
Questions
Which characters need escaping?
At minimum & < > " and '. The ampersand must be escaped first, otherwise escaping the others would produce broken double-encoded entities.
Does escaping HTML prevent XSS?
It is a necessary part of it, but not sufficient on its own. Escaping is context-dependent — text inside an attribute, a URL, a style block or a script block each need different treatment. Use your framework’s escaping rather than doing it by hand.
What is and why does it keep appearing?
A non-breaking space. Editors and word processors insert it to stop lines wrapping, and it survives copy-paste invisibly. It is a common cause of text that looks right but does not match in a search.
Does it handle numeric entities?
Yes. Decoding understands decimal (A) and hexadecimal (A) forms as well as the named ones.