HTML Encoder/Decoder
Encode HTML special characters to entities or decode HTML entities back to characters.
Safe conversion with no data sent to server
Last updated: March 2026
What is HTML Encoding and Decoding?
HTML encoding (also called HTML escaping) is the process of replacing special characters with their corresponding HTML entities so they display correctly in web browsers and do not interfere with HTML markup. The five critical characters that must be encoded are: < (less than), > (greater than), & (ampersand), " (double quote), and ' (single quote/apostrophe). Without encoding, the browser interprets these characters as HTML syntax rather than literal text.
HTML entities come in two forms: named entities (like < for < and & for &) and numeric entities (like < for < and & for &). Named entities are more readable, while numeric entities can represent any Unicode character, making them useful for special symbols, emoji, and characters from non-Latin scripts. This tool supports both encoding modes.
HTML decoding is the reverse process: converting entity references back into the original characters. This is necessary when processing HTML content that has been escaped, extracting text from HTML documents, or preparing content that was stored in encoded form for display in non-HTML contexts. Proper encoding and decoding are fundamental to web security, specifically in preventing Cross-Site Scripting (XSS) attacks.
How to Use This HTML Encoder/Decoder
To encode HTML:
- Select "Encode" mode.
- Choose your entity type: Named (e.g.,
<) for readability, or Numeric (e.g.,<) for maximum compatibility. - Paste or type your text containing special HTML characters into the Input field.
- Click "Encode HTML" to convert all special characters to their entity equivalents.
- Copy the encoded output for safe insertion into HTML documents.
To decode HTML entities:
- Switch to "Decode" mode.
- Paste text containing HTML entities (named or numeric) into the Input field.
- Click "Decode HTML" to convert all entities back to their original characters.
Example: Encoding <script>alert("XSS")</script> produces <script>alert("XSS")</script>, which renders as visible text rather than executable code.
Common Use Cases
- XSS prevention: Encode user-generated content before displaying it in HTML pages to prevent cross-site scripting attacks that inject malicious JavaScript.
- Displaying code snippets: Encode HTML, CSS, or JavaScript code examples so they appear as visible text on web pages rather than being interpreted by the browser.
- Email template development: Encode special characters in HTML email templates to ensure consistent rendering across different email clients.
- CMS content management: Encode content that will be stored in databases and later rendered in HTML, ensuring special characters are preserved correctly.
- XML/HTML attribute values: Encode values that will be placed inside HTML or XML attributes where quotes and angle brackets would break the markup.
- Web scraping cleanup: Decode HTML entities in scraped web content to extract clean, human-readable text for analysis or processing.
- SEO meta tags: Properly encode special characters in meta descriptions and title tags to ensure search engines and social media platforms display them correctly.
FAQ
What is the difference between named and numeric HTML entities?
Named entities use descriptive names like <, >, and &. They are easier to read in source code but are limited to a predefined set of characters. Numeric entities use Unicode code points like < (decimal) or < (hexadecimal) and can represent any Unicode character, including emoji and symbols from all writing systems.
Why is HTML encoding important for security?
HTML encoding is the primary defense against Cross-Site Scripting (XSS) attacks. Without encoding, an attacker could inject strings like <script>stealCookies()</script> into user input fields, and the browser would execute the script. Encoding converts the angle brackets to harmless entities, so the input displays as text instead of running as code.
Does encoding affect how text looks on the web page?
No. When a browser renders an HTML page, it automatically decodes entities and displays the original characters to the user. The encoding exists only in the HTML source code. So & in the source appears as & to the visitor, and < appears as <.
Should I encode all characters or just the special five?
For most use cases, encoding only the five special characters (<, >, &, ", ') is sufficient. These are the characters that could break HTML syntax or enable injection attacks. Encoding every character (full numeric encoding) is sometimes used for obfuscation or extreme compatibility but is rarely necessary and makes the source code much harder to read.