HTML Entity Encode & Decode
Encoding & CryptoEverything runs locally in your browser — nothing is uploaded
Turn < > & " and the single quote into entities, or turn entities back into characters. Encoding touches only those five, which are the ones with real syntactic meaning in HTML: they decide where a tag starts and where an attribute value ends. Every other character is perfectly valid as a literal, and escaping all of them just makes the output unreadable and impossible to diff. Decoding understands named entities (the 200+ that actually show up in web pages) plus decimal references like 中 and hexadecimal ones like 中, and it runs exactly one pass: &lt; becomes <, never <, because repeated decoding is the classic way XSS gets through. Unknown entities are passed through untouched rather than thrown away.
Features
- Both directions: text ⇄ HTML entities
- Escapes only the five syntax-significant characters, leaving the rest readable
- Optional numeric escaping of non-ASCII characters, including emoji
- Decodes 200+ named entities: nbsp, copy, mdash, arrows, maths symbols, Greek letters
- Decodes both decimal 中 and hexadecimal 中 numeric references
- Single-pass decoding, so &lt; yields < rather than <
- Unknown entities and out-of-range code points are passed through untouched
How to use
- Pick the direction: encode or decode
- Tick "escape non-ASCII" if you need the whole text ASCII-only
- Paste your content — the result appears instantly
- Click Copy to take the result
FAQ
- Why only five characters?
- Because in HTML only < > & " and the single quote carry syntax: they mark where a tag begins, where an attribute value ends and where an entity starts. Everything else, including CJK text and emoji, is valid as a literal, and escaping all of it only makes the markup hard to read. If you do need ASCII-only output, tick the non-ASCII option.
- Why is the single quote ' and not '?
- ' only arrived with XML and HTML5, and older parsers do not know it. The numeric reference ' is equivalent to a single quote everywhere, which makes it the safer choice.
- Why does &lt; decode to < and not to a literal angle bracket?
- The decoder runs a single pass, which is the safe behaviour. Decoding repeatedly is what lets input like &lt;script&gt; slip past a filter that only cleans once — the classic route to XSS. If you really need a second pass, run the result through again deliberately.
- Why are some entities left alone?
- This tool covers the 200+ entities that appear in real web pages rather than the full HTML5 list of 2200+, which would multiply the page size. Anything outside the table, such as &foo;, is kept exactly as written — you can see that it was not handled instead of getting an error or silently losing it.
Related tools
Unicode Escape
Encoding & CryptoConvert non-ASCII text and emoji into \uXXXX or \xXX escapes and back, with emoji written as proper surrogate pairs. Runs entirely in your browser.
URL Encode
Encoding & CryptoEscape text into %XX form and back again, treating a whole URL and a single parameter value as different jobs. Runs entirely in your browser.
HTML Formatter
FormattingFormat HTML online by tag level, keeping text and inline tags on one line and script or pre content untouched. Runs locally, with nothing uploaded.
Base64
Encoding & CryptoConvert text to Base64 and back, with correct UTF-8 handling for accents, CJK and emoji. Runs entirely in your browser — nothing is uploaded.
JWT Decoder
Encoding & CryptoSplit a JWT into header, payload and signature, and read iat, nbf and exp as dates. The signature is not verified — decoding only, all in your browser.
Hash
Encoding & CryptoCompute MD5, SHA-1, SHA-256 or SHA-512 digests of any text, hashed as UTF-8 bytes so they match openssl and sha256sum exactly. Runs in your browser.