HTML Entity Encoder & Decoder
Encode and decode HTML entities and JavaScript escapes.
encodes only & < > " ' — the correct set for inserting text into HTML
How do you HTML-encode special characters like < > & and quotes?
This tool converts reserved characters — &, <, >, quotes, accented letters — into their HTML entity equivalents (&, <, >…), and reverses the process with tolerant decoding that accepts named, decimal and hex entities mixed in the same string. Pick a scope: the 5 essential characters needed to safely drop user text into HTML, or every non-ASCII character (accents, symbols, emoji) for maximum compatibility with older systems. A separate mode handles JavaScript and JSON string escapes (\n, \t, quotes, \uXXXX) in both directions. Encoding the minimal set (&, <, >, ", ') is the standard first defense against XSS: it turns potentially executable markup into inert text before it ever reaches the DOM. Decoding never touches the DOM either — no innerHTML, no element injection — it's pure string parsing. Everything runs in your browser; nothing is uploaded. Free, no signup, no limits.
How to use HTML Entity Encoder & Decoder
- Choose the operation type — HTML entities or JavaScript/JSON string escapes — and the direction: encode or decode.
- For HTML encoding, pick the scope (essential characters only, or all non-ASCII) and the output format: named, decimal or hexadecimal.
- Paste or type the text into the input panel. The result is generated instantly on the right, with entities highlighted.
- Copy the result to the clipboard or download it as a .txt file with one click.
Common use cases
Prevent XSS when rendering user-supplied text
Encode comments, usernames or any user input before inserting it into an HTML template, so a payload like <script>alert(1)</script> renders as literal text instead of executing.
Show HTML markup as text in documentation
Convert example HTML tags into entities so they display as visible text in tutorials, READMEs or blog posts, instead of being interpreted as real markup by the browser.
Debug API responses with escaped characters
Decode strings that arrive with a mix of named, decimal and hex HTML entities from a CMS, RSS feed or scraped page, to inspect the actual underlying text.
Prepare strings for JSON payloads or JS source
Escape line breaks, quotes and accented characters so a block of text can be pasted directly as a valid string literal into a .json file or JavaScript code without breaking syntax.
Keep compatibility with legacy systems
Encode accents and symbols as numeric entities when the destination system doesn't handle UTF-8 well, so text doesn't arrive corrupted or full of mojibake.
Frequently asked questions
What characters must always be encoded before inserting text into HTML?
At minimum & < > " ' — the five characters the HTML parser treats as markup or attribute delimiters. Encoding them is the first line of defense against XSS whenever you insert user-supplied text into a page.
Does encoding HTML entities fully prevent XSS?
It significantly reduces the risk by neutralizing executable markup, but it isn't the only defense: context-aware sanitization (HTML, attribute, URL, JS contexts), Content-Security-Policy and server-side validation still matter. It's one layer, not the whole strategy.
What's the difference between é and é?
They represent the same character (é): é is the named entity, é is the same code point in decimal, and é in hexadecimal. Browsers accept all three forms interchangeably — the choice is purely about readability or legacy support.
Why does an entity work even without a trailing semicolon?
The HTML5 spec allows omitting the trailing ; for a defined set of legacy entities when the next character isn't alphanumeric. This decoder is deliberately tolerant and recognizes entities with or without the semicolon.
How do I escape text to paste inside a JSON string?
Use the JSON escape mode: it converts line breaks to \n, tabs to \t, double quotes to \" and any non-ASCII character to \uXXXX, leaving the text ready to drop between double quotes in a valid JSON document.
Is the text I paste sent to a server?
No. All encoding and decoding happens in your browser's memory using pure string parsing — no DOM elements are created and innerHTML is never touched — and it keeps working offline once the page has loaded.