HTML Encode and Decode Online
This free tool converts special characters into HTML entities and decodes entity-laden markup back into plain text. Encoding turns < into <, & into &, and so on, which lets you display code samples and user-supplied text inside a web page without the browser interpreting it as markup.
Decoding is the reverse: paste text full of entities like " or ’ — common when scraping pages or reading exported CMS content — and get clean, readable text back. The tool uses a safe, standards-based parser and runs entirely in your browser.
How to use HTML Encode/Decode
- Choose Encode to escape special characters, or Decode to convert entities back to text.
- Paste your text or markup into the Input box.
- Press Process, then copy or download the result.
What are HTML entities?
An HTML entity is an escape sequence that represents a character which would otherwise be interpreted as markup or is hard to type. Entities are written as a name (< for <), a decimal number (<), or a hexadecimal number (<). The five characters that must always be escaped in HTML content are <, >, &, " and '.
<a href="page.html">Link & more</a> → <a href="page.html">Link & more</a>
Why encoding matters for security
Escaping user-supplied text before inserting it into a page is the primary defense against cross-site scripting (XSS). If untrusted input is written into HTML unescaped, an attacker can inject script tags or event handlers that run in other users' browsers. Always HTML-encode dynamic content — and note that this tool's decoder parses input inertly, without executing scripts or loading resources.
Related terminology
- HTML entity
- An escape sequence such as & or © that represents a single character in HTML source.
- Escaping
- Rewriting characters that have special meaning so they are treated as literal text — the encode direction of this tool.
- Cross-site scripting (XSS)
- A vulnerability where unescaped user input injects executable markup into a page; prevented by HTML-encoding output.
- Character reference
- The formal name for numeric entities like 😀, which can express any Unicode character.
Frequently asked questions
- When should I HTML-encode text?
- Whenever text will be placed inside HTML and should display literally: code snippets in blog posts, user comments, product names containing & or <, and any dynamic value rendered into a template.
- How do I convert & back to &?
- Select Decode mode, paste the text containing entities, and press Process. Named, decimal, and hexadecimal entities are all converted back to their characters.
- Is it safe to decode untrusted HTML here?
- Yes. Decoding uses an inert HTML parser that never executes scripts, loads images, or fires event handlers, and only the resulting plain text is returned.
- What is the difference between HTML encoding and URL encoding?
- HTML encoding (<) protects characters inside web page markup, while URL encoding (%3C) protects characters inside web addresses. Use the URL Encode/Decode utility for URLs.