HTML Entity Encoder & Decoder: a practical guide

When this is useful

HTML-sensitive characters need escaping when you want to display them as text or place text inside an attribute. An ampersand or less-than sign can otherwise be interpreted as markup. Encoding and decoding are representation changes; neither operation decides whether untrusted HTML is safe to execute.

A reliable workflow

Encode converts ampersands, angle brackets, double quotes, and apostrophes to entities. Decode understands amp, lt, gt, quot, apos, nbsp, copy, reg, and decimal or hexadecimal numeric references. The decoded result is displayed as text, including any apparent tags, rather than inserted into the page as HTML.

Example input: <h1>Hello & welcome</h1>

What to check before you finish

This decoder does not implement the complete HTML5 named-entity table. Unknown named entities remain unchanged and invalid Unicode references become a replacement character. Do not use the output as a sanitizer or a substitute for context-aware escaping, DOM-safe insertion, or a maintained HTML sanitization library.

Keep the next step simple

Open the HTML Entity Encoder & Decoder above to try the workflow. Your input is processed in your browser, without an account or file uploads. The related tools below can help with the next step; check the output before publishing it or adding it to a production system.