HTML Encoder/Decoder
Escape HTML characters to safe entities, or decode entities back into raw HTML.
Encoding turns characters like < > & " into their safe HTML entity equivalents (< > & ") so they display as text instead of being interpreted as markup — essential when showing user-submitted or code content inside a web page. Decoding reverses this, turning entities back into their original characters.
Why unencoded HTML characters break pages
A web browser interprets characters like < and > as the start and end of an HTML tag no matter where they appear in a page's source, which means displaying raw user-submitted text containing those characters can accidentally create broken or unintended markup, or in more serious cases, open the door to a cross-site scripting vulnerability if someone deliberately submits malicious script tags. Encoding those characters into their entity equivalents tells the browser to display them literally as text instead of treating them as markup instructions.
Why this matters even more for displaying code snippets
Tutorial sites, documentation pages, and forums that show code examples (like this very concept) have to encode any HTML or script tags that appear within that example code, or the browser will try to actually execute or render them as real markup instead of showing them as an example. This is one of the most common practical reasons developers reach for an HTML encoder — making a code sample containing tags actually display as visible text.
Named entities versus numeric entities
The five characters with dedicated named entities (& < > " ') are the most common ones needing escaping in everyday HTML, but any character can also be represented using its numeric Unicode code point instead, like © for a copyright symbol. This tool's decoder correctly handles both named and numeric entity formats when converting encoded text back to its original characters.
How to use it
- Paste text or HTML into the input box.
- Click Encode to escape special characters, or Decode to reverse entities back to characters.
- The result replaces the box content.
- Copy the result for use in your code or CMS.
Common ways people use this tool
Displaying a code snippet on a webpage
Encode a block of HTML or JavaScript code so it displays as visible text on a page instead of being rendered or executed.
Safely showing user-submitted content
Encode user-submitted text before displaying it on a page to prevent it from being interpreted as unintended markup.
Reading encoded content from a CMS export
Decode HTML entities found in exported content from a content management system back into readable, plain text or markup.
Tips for getting the best results
- Always encode user-submitted or external content before displaying it directly in a webpage, as a basic security precaution.
- When showing code examples on a page, encode the entire snippet, not just specific tags, to avoid the browser misinterpreting any part of it.
- Remember decoding entities and then re-inserting the result into live HTML negates the protection encoding provided — only decode when you specifically need the plain, literal characters.
- Double-check ampersands (&) specifically, since they're both extremely common in ordinary text and one of the five core characters needing encoding.
Frequently asked questions
Why do I need to encode HTML before displaying it?
If you show raw user input containing < or > inside a web page without encoding it, it can be interpreted as real HTML tags — encoding prevents that and also helps prevent injection attacks.
What characters get encoded?
The core five: & < > " and ' become & < > " and ' respectively.
Can I decode entities that use numeric codes like '?
Yes, both named entities (like &) and numeric entities are decoded correctly.
Is encoding HTML the same as sanitising it for security?
Encoding is one important piece of preventing certain injection attacks, but full security sanitisation of untrusted input for a real application typically involves additional server-side validation beyond just entity encoding.
Will encoding change how my text displays visually to a reader?
No — properly encoded text still displays with the original characters visible to a reader; only the underlying HTML source changes to represent those characters safely.
Can I encode an entire HTML document, not just a snippet?
Yes, though encoding an entire document turns all of its tags into visible text rather than rendered markup, which is intentional if you want to display the document's raw source rather than render it.
What happens if I try to decode text that has no entities in it?
It's returned unchanged, since there's nothing to decode — running decode on already-plain text is a safe, no-op operation.
Does encoding affect emoji or non-English characters in my text?
No, only the specific reserved HTML characters (like < > & " ') are converted to entities — emoji and other Unicode text pass through unchanged since they don't have special meaning in HTML markup.
Can I encode a very large block of text, like a full webpage's source?
Yes, there's no practical size limit since the encoding runs instantly in your browser regardless of how much text is provided.
Why do some HTML entities have both a named and numeric version, like & and &?
Both represent the exact same character and are functionally interchangeable — named entities tend to be more human-readable in raw source code, while numeric entities are sometimes generated automatically by software that doesn't maintain a full lookup table of names.