HTML Entity Encoder & Decoder

What this does

Converts text to and from HTML entities. Four encoding modes:

• Minimal — only the five characters that break HTML or enable XSS: &, <, >, ", '. This is what you actually need for HTML escaping in 99% of cases. Output stays human-readable.
• Named — uses named entities like é and © where available, falls back to the original character or numeric depending on the toggle. Easier to read in source but heavier output.
• Numeric — é style. Decimal Unicode code point. Maximum compatibility — works in any HTML parser even if it doesn’t know the named entity.
• Hex — é style. Same encoding as numeric but in hexadecimal. Common in older XML and some email systems.

The “also encode all non-ASCII” toggle is for when you need to ship pure ASCII over a transport that mangles UTF-8 (legacy email, some CSV exports, certain log aggregators).

The decode button uses the browser’s built-in HTML parser, so it correctly handles all 2000+ named entities including obscure ones like ♣ and ♥ without us shipping the full table.

When you actually need this

• Output user-supplied text into HTML. This is the XSS prevention case. Always encode at minimum & < > " ' before injection. Never trust user input.
• Convert smart quotes for RSS/Atom feeds. " → “ keeps Word-pasted content from breaking strict XML parsers.
• Generate HTML from a templating system that doesn’t auto-escape. Old systems (raw PHP, classic ASP, hand-rolled string concat) need explicit encoding. Modern frameworks (React JSX, Hugo, Jinja2 with autoescape on) do this for you — don’t double-encode.
• Inspect what an existing entity-laden string actually says. Decode <script> to see what was meant.
• Migrate content between systems. WordPress export → Hugo, MediaWiki → Markdown, etc. Different systems handle entities differently; converting to a normal form helps.

What this is NOT for

• URL encoding. That’s %20 not  . Different encoding scheme.
• JavaScript string escaping. \n and é belong in JS source, not HTML.
• Database storage. Store the raw character in UTF-8. Encode only when emitting to HTML.
• JSON encoding. Use JSON.stringify (or our JSON Formatter ). HTML entities inside JSON won’t decode.

A common mistake is double-encoding — running encode twice produces & instead of &. If you’re seeing & in rendered output where you expected &, you’re encoding text that was already encoded. Decode first.

Privacy

The tool runs entirely in your browser. The textarea contents never leave your machine.

Related tools