Skip to content
T
Tools.Town
Free Online Tools for Everyone
&

HTML Entity Encoder

100% Free

Encode and decode HTML entities both directions — escape &, <, >, quotes, and decode named, decimal, and hex entities back to text.

Both Directions
Instant
100% Client-Side
No Sign Up
Encode options:
Encoding scope

Encode (Text → HTML Entities)

Encoded output
8 escaped
&lt;a href=&quot;x&quot;&gt;Tom &amp; Jerry&#39;s&lt;/a&gt;

Decode (HTML Entities → Text)

Decoded output
6 decoded
<p>Tom & Jerry's</p>

Common HTML Entities

Reference table of common HTML entities
CharNamedNumericName
&&amp;&#38;Ampersand
<&lt;&#60;Less than
>&gt;&#62;Greater than
"&quot;&#34;Double quote
'&apos;&#39;Apostrophe
&nbsp;&#160;Non-break space
©&copy;&#169;Copyright
&mdash;&#8212;Em dash

Embed This Tool

Easy to Embed

Add HTML Entity Encoder to your website or blog in seconds.

  • Responsive design
  • Lightweight & fast
  • No backend required
  • Always up-to-date
<iframe
  src="https://tools.town/embed/html-entity-encoder/"
  width="100%"
  height="600"
  style="border:none; border-radius:12px;"
  loading="lazy"
  title="HTML Entity Encoder">
</iframe>

Share This Tool

Share Instantly

Share HTML Entity Encoder with anyone — no login required.

  • Shareable link
  • No login required
  • Works on any device
  • No account needed

Share via

Advertisement

How to Use

  1. 1 Paste text into the Encode panel to convert it into HTML entities
  2. 2 Or paste entity-laden markup into the Decode panel to get readable text
  3. 3 Choose to escape just the core five characters or all non-ASCII
  4. 4 Toggle hex numeric entities if your pipeline prefers &#x27; style
  5. 5 Copy the encoded or decoded result with one click

Features

  • Encode and decode in two side-by-side panels
  • Escapes the must-encode set: & < > double and single quotes
  • Optional full non-ASCII escaping to numeric entities
  • Decodes named, decimal, and hexadecimal entities
  • Hex or decimal numeric output toggle
  • Runs entirely in your browser — nothing is uploaded

Why it Matters

Dropping raw text into HTML without escaping it is the classic source of broken layouts and cross-site scripting holes. Encoding the characters that have special meaning in markup — the ampersand, angle brackets, and quotes — makes content render exactly as written and keeps user input from being parsed as code. Decoding does the reverse when you need the plain text back.

★★★★★

Use Cases

Safe HTML Output

Escape user content before placing it inside markup

Prevent XSS

Neutralise angle brackets and quotes in untrusted input

Debug Encoded Text

Decode entity soup back into readable characters

Email & Feeds

Produce entity-safe text for XML, RSS, and HTML email

What this tool does

The HTML Entity Encoder converts text into HTML-safe entities and back again. Encoding escapes the characters that have special meaning in markup — the ampersand, the angle brackets, and the quotes — so your content renders literally instead of being parsed as HTML. Decoding turns named, decimal, and hexadecimal entities back into the characters they represent.

How it works

Encoding walks your text character by character and replaces each special character with its entity, always escaping the ampersand first so the output never double-encodes. The optional “all non-ASCII” scope additionally converts any character outside printable ASCII into a numeric entity. Decoding matches every entity sequence and resolves named entities, decimal references, and hex references. The logic is a pure function — the same input always produces the same output.

Privacy

Everything runs locally in your browser. No values are uploaded, logged, or stored.

Frequently Asked Questions

Which characters actually need to be encoded in HTML?
Five characters carry special meaning and should be escaped in most contexts: the ampersand, the two angle brackets, the double quote, and the apostrophe. The ampersand must be escaped first, otherwise it would corrupt the other entities. Inside attribute values the quotes matter most; in text content the angle brackets matter most.
What is the difference between named and numeric entities?
Named entities like &amp; and &copy; use a human-readable keyword. Numeric entities reference a character by its Unicode code point, either in decimal (&#169;) or hexadecimal (&#xA9;). They render identically; named entities are easier to read, while numeric entities work for any character even without a defined name.
Does encoding protect me from cross-site scripting?
Encoding the angle brackets and quotes in untrusted text before inserting it into HTML is a core defence against XSS, because it stops the browser from treating that text as tags or attributes. It is not a complete security strategy on its own — context matters, and JavaScript or URL contexts need their own escaping — but HTML entity encoding is an essential first step.
Why does the ampersand have to be encoded first?
Every HTML entity begins with an ampersand. If you escaped the angle brackets before the literal ampersands, a second pass could turn the ampersand inside an entity into &amp; and double-encode your output. This tool always escapes the ampersand first so the result is correct and round-trips cleanly.
Is my text sent to a server?
No. Both encoding and decoding run entirely in your browser with JavaScript. Nothing you paste is uploaded, logged, or stored, and refreshing the page clears everything.

Related Tools You Might Like

Browse more free tools