HTML Entity Encoder/Decoder
Convert between plain text and HTML-entity-encoded text, in both directions. Encoding always escapes the five structurally-special characters (& < > " '), with optional modes to also encode all non-ASCII characters or every character as a numeric reference. Decoding recognizes both named entities (&, ©, …) and numeric references in decimal (©) or hex (©) form. Runs entirely client-side — nothing is uploaded.
About this tool
This tool converts between plain text and HTML-entity-encoded text, in both directions. The five characters with special meaning in HTML (& < > " ') are always encoded by name, since decoding them isn't optional — leaving a literal < or & in HTML output can break markup or open an XSS injection point. Beyond those five, you can choose whether to leave other characters as-is, encode all non-ASCII characters numerically (useful for older systems or email templates with limited charset support), or encode every character numerically. Decoding recognizes both named entities (&, ©, …, and other common ones) and numeric character references in either decimal (©) or hexadecimal (©) form. It runs entirely client-side — nothing you paste is ever sent anywhere.
What you can do
- Encode text to HTML entities, or decode entities back to text — both directions
- Three encode modes: predefined entities only, non-ASCII as numeric, or every character as numeric
- Decodes both named entities (&) and numeric references, decimal or hex (& / &)
- Nothing is uploaded — every conversion happens locally in your browser
How to use
Step 1
Pick a direction
Encode or Decode — conversion happens instantly as you type.
Step 2
Paste your text
Encoding text with special characters, or an already-encoded HTML string to decode.
Step 3
Copy the result
Copy the encoded or decoded output directly.
Example
This text:
Text
<a href="x">Tom & Jerry's</a>
Encoded
<a href="x">Tom & Jerry's</a>
encodes to that — safe to embed literally inside HTML without being interpreted as markup.
How your data is handled
This tool is labeled 🟢 Browser: your text is encoded or decoded directly in your browser — nothing is uploaded to a server, and nothing about it is retained once you leave the page.
Frequently asked questions
Why are &, <, >, ", and ' always encoded, even in the most minimal mode?+
Those five characters have structural meaning in HTML — an unescaped < can be parsed as the start of a tag, and an unescaped " can break out of an attribute value. Encoding them is what keeps arbitrary text safe to embed inside HTML.
What's the difference between the three encode modes?+
"Named entities only" touches just those five characters and leaves everything else (including accented letters and emoji) untouched. "All non-ASCII as numeric" additionally converts every character outside the basic ASCII range into a numeric reference. "Every character as numeric" converts everything, including plain letters — rarely needed, but sometimes used to fully obfuscate an email address from simple scrapers.
What entities does decoding recognize?+
The five predefined ones (amp, lt, gt, quot, apos), a set of other common named entities (nbsp, copy, mdash, hellip, and similar), and any numeric character reference in decimal (©) or hexadecimal (© or ©) form.
Is my text uploaded anywhere?+
No — encoding and decoding both happen directly in your browser. Nothing here ever leaves your device.